Advertise on podcast: Tenable Research Podcast

This month we talk to Tenable research manager Scott Caveza about three recent patching stories, where F5 and Microsoft offered fixes in a regular cycle, and how Amazon Web Services released hot patches to repair earlier vulnerabilities in fixes for Log4J. F5 BIG-IP Patch Hot Patches for Log4J May Patch TuesdayCVE-2021-36942 Follow along for more from Tenable Research Subscribe to the blogFollow Tenable's Zero Day team on Medium

On this edition of the podcast, we look at the conversation around operational technology (OT) and attacks on critical infrastructure, as we mark a year since the Colonial Pipeline incident. We’re joined by Tenable’s VP of operational technology Marty Edwards to talk about lessons learned, what work there is still to be done by practitioners, industry and researchers, and where the problems remain. Tenable blog - Securing Critical Infrastructure its Complicated  Amit Yoran Testimony Video of the Homeland Security Committee Joint Cybersecurity Advisory CBS News 60 Minutes Report  NCSC blog on Cyber Assessment Framework  Follow along for more from Tenable Research: Subscribe to the blogFollow Tenable's Zero Day team on Medium

This month we take a deep dive into the most recent Java related vulnerability, and ask what the situation was with this, how it got confused with another vulnerability, and how significant it is to the wider threat landscape - or was it just riding on the memory of Log4J? We also look at the April patches from Microsoft, and two lots of fixes from VMware. Spring4Shell FAQ: Spring Framework Remote Code Execution Vulnerability  Microsoft’s April 2022 Patch Tuesday Addresses 117 CVEs VMware vCenter Server Sensitive Information Disclosure Vulnerability  VMware Patches Multiple Vulnerabilities in Workspace ONE, Identity and Lifecycle Manager and vRealize  Threat Landscape Retrospective 2021 Download  Follow along for more from Tenable Research: Subscribe to the blog Follow Tenable’s Zero Day team on Medium

Have you ever sat in the audience at a conference, watched a video of a presentation, or listened to an interview on a podcast or TV, and seen a researcher and thought ‘how do I get to do that?’ Tenable now has a wide selection of researchers, covering security response, zero day research, audit and compliance and writing software plugins. With more companies employing full time researchers now, we talked to two from Tenable about what the job entails, what you need to know to get hired, and what a typical day or week looks like. Joining this month are research senior managers Ivan Belyna and Jesus Garcia Galan. Research Jobs Tenable Careers  Tenable Research 

This month we look at newly-released, important-rated patches from Microsoft, and a new blog from Tenable’s Security Response Team where more vulnerabilities from 2021 were discussed, and why they did not make the final top five in our Threat Landscape Retrospective.  March Patch Tuesday  Behind the Scenes: How We Picked 2021's Top Vulnerabilities – and What We Left Out  2021 Threat Landscape Retrospective 

This month we talk to Renaud Deraison, outgoing CTO and a co-founder of Tenable, who talks about his time developing Nessus from an open source scanner in 1998 to the development of Tenable over the past 20 years, and what the future looks like for him. Nessus Professional Tenable Research Tenable Blog

This month we look at new patches released by Cisco, Microsoft and SAP, and while there were some very critical vulnerabilities patched, we also saw Microsoft change tact with a significantly reduced patch bundle and with no critical patches released. Patch Tuesday Blog  SAP Patches Internet Communication Manager Advanced Desync (ICMAD) Vulnerabilities   Threat Landscape Retrospective Download Page  Critical Flaws in Cisco Small Business Routers  Tenable Research Podcast on CISA

As it is Black History Month in North America in February, we talked to the co-chairs of Black@Tenable, the diversity and inclusion group for African-American employees of Tenable, about the recognition of black leaders in technology, efforts to increase the hiring of people of color in cybersecurity, and how the industry is responding to that. Tenable Homepage Tenable Careers Black History Month

In our first look at the research highlights of 2022, we take a deep dive into Tenable’s 2021 Threat Landscape Retrospective, and look at the incidents, attacks and notable vulnerabilities that made up the past year. We also look at new advisories from January 2022, with new patches from Microsoft and ZoHo, and the new CVEs in Apache Log4j 1.x. Threat Landscape Retrospective Download Page  TLR Webinar Registration Page  TLR Blog Post  PrintNightmare CVE 2021-36958 Tenable Log4J Website  ZoHo Patches  Microsoft January Patches  Follow along for more from Tenable Research: Subscribe to the blog Follow Tenable’s Zero Day team on Medium

This month we take a look back at the impact of Log4J and how both the industry and Tenable were able to respond to this major incident that affected so many users globally. There are also fresh fixes from SonicWall and ZoHo for ManageEngine, and the final batch of patches from Microsoft as it rounds off a quieter year. Proof-of-Concept for Critical Apache Log4j Remote Code Execution Vulnerability Available (Log4Shell) Log4j Resource Page Log4J Tenable Webinar  SonicWall Urges Users to Patch Several Vulnerabilities in Secure Mobile Access Products  ZoHo Patches ManageEngine Zero-Day Exploited in the Wild Microsoft’s December 2021 Patch Tuesday Addresses 67 CVEs  Follow along for more from Tenable Research: Subscribe to the blog Follow Tenable’s Zero Day team on Medium

The recent Binding Operational Directive from CISA will see a number of U.S. government departments receive better instruction on which vulnerabilities need to be patched, and to do so within a six month time frame.  On this episode of the Tenable Research podcast, we talk to Nathan Wenzler and Seth Matheson about what the vulnerabilities are, how they are determined, who is affected and what this could mean for other governments around the world, and other businesses also. Show references: Binding Operational Directive 22-01  CISA Directive 22-01: How Tenable Can Help You Find and Fix Known Exploited Vulnerabilities  https://cyber.dhs.gov/bod/22-01/ How Risk-Based Vulnerability Management Helps You Effectively Address CISA’s Binding Operational Directive 22-01

This time we’re joined by Tenable’s security strategist Sylvain Cortes, as we look at the types of attacks being targeted at Active Directory, how attackers look to get a foothold into enterprise networks by exploiting AD, and what steps you can take to better secure yourself and your AD environment  Active Directory is Now in the Ransomware Crosshairs  How to Protect Active Directory Against Ransomware Attacks How to Strengthen Active Directory and Prevent Ransomware Attacks