Starburst Appoints Jitender Aswani as SVP of Engineering to Lead Innovation for Data Platform and Accelerate AI Deployment

Posted in Commentary with tags on April 22, 2025 by itnerd

Starburst, the data platform for apps and AI, today announced the appointment of Jitender Aswani as Senior Vice President of Engineering. Aswani brings more than two decades of experience building and scaling high-performance technical teams, with deep expertise in machine learning, data infrastructure, and cloud technologies. In his new role, Aswani will lead Starburst’s global engineering organization and drive innovation across its modern data platform for apps and AI. He will report directly to Starburst CEO and Co-Founder, Justin Borgman.

Aswani joins Starburst with a proven track record of engineering leadership at some of the world’s most innovative technology companies. Most recently, he was Vice President of Engineering at StarTree, where he led engineering strategy and execution for distributed, multi-cloud real-time analytics platforms. He also served as the acting Chief Information Security Officer (CISO), overseeing the company’s security strategy and operations.

Previously, Aswani was Head of Engineering at Moveworks, leading teams that built AI-powered enterprise solutions. He held leadership roles at both Netflix and Meta, where he specialized in data science, security, and infrastructure. At Meta, he was one of the first users of Trino (formerly Presto) at Facebook, giving him a unique and valuable perspective on Starburst’s core technology.

Aswani’s experience spans early-stage startups to global enterprises, giving him a thoughtful approach to scaling teams and applying the right amount of process at each stage of growth. He holds multiple patents in machine learning, data management, and graph optimization, and earned an MBA from the University of Chicago Booth School of Business.

Ericsson boosts NetCloud SASE with industry’s first fully integrated clientless ZTNA solution for Wireless WAN

Posted in Commentary with tags on April 22, 2025 by itnerd

Ericsson today announced an expansion of its NetCloud SASE with clientless Zero Trust Network Access. This innovation empowers organizations to securely connect third-party and BYOD users to authorized resources with enhanced security. Building on Ericsson’s existing client-based ZTNA, the new solution offers flexibility for lean IT teams navigating managed and unmanaged devices in dynamic, wireless-first settings. 

According to KPMG, 73 per cent of organizations have experienced at least one major disruption tied to third-party cyber incidents over the past three years. Ericsson’s clientless ZTNA solution enhances protection against these events with embedded isolation technology. Unlike other clientless solutions relying solely on access controls, NetCloud SASE activates application sessions in isolated cloud containers for unmanaged or BYOD device access. This air-gaps corporate systems from potentially insecure devices, preventing malware spread into the enterprise. 

Key features of NetCloud SASE with clientless ZTNA include: 

  • Clientless Secure Access: Contractors and BYOD users can access isolated applications via a secure URL, eliminating the need for VPNs, clients or special browsers. 
  • IoT/OT asset and corporate application protection: Interactions between unmanaged users and corporate systems are isolated in cloud containers, safeguarding applications from potential malware infections. 
  • Granular access based on least privilege: Access is controlled by detailed policies based on user roles, device types, and other factors, ensuring users receive only the necessary level of access. 
  • Continuous Risk Assessment: Real-time analytics and intrusion detection system/intrusion prevention system (IDS/IPS) allow for instant access revocation in response to changes in user context and risk levels. 
  • Zero-trust based: This unique architecture removes the need for static public IP addresses, hides all internal IPs, defaults to deny all, and enables micro-segmentation, which prevents lateral movement within the network. 
  • Single-platform Management: Integrated into NetCloud Manager for simplified deployment, visibility, and policy enforcement alongside 5G WWAN, SD-WAN, and other SASE security features. 
  • Seamless integration with Existing Identity Providers: Leverages existing enterprise Identity and Access Management (IAM) platforms for seamless user authentication and authorization, preventing identity sprawl. 

NetCloud SASE with clientless ZTNA is now available and included as part of the NetCloud ZTNA license. The solution will be showcased at RSA Conference on April 28, 2025, marking the first time an enterprise 5G router vendor has delivered a fully integrated, clientless ZTNA solution under fully unified management.  

To learn more about Ericsson Enterprise Wireless Solutions security capabilities, please visit the Ericsson NetCloud SASE page. 

Gamers beware: Flashpoint Research Team Issues Blog Detailing The AgeoStealer Infostealer

Posted in Commentary with tags on April 22, 2025 by itnerd

Flashpoint just published a blog about AgeoStealer. Which is an Infostealer.

Infostealers have proven to be a gold mine for threat actors, responsible for stealing 75%—or 2.1 billion—of 2024’s 3.2 billion total credentials, fueling a constant cycle of account takeover attacksransomware, and high-profile data breachesIn our 2025 Global Threat Intelligence Report, we detailed their meteoric rise as a primary threat vector, with our analysts tracking over 24 unique stealer strains—such as RedLine, RisePro, and Lumma Stealer—being listed for sale on illicit marketplaces. Now, organizations will need to add AgeoStealer to their watch list as cybercriminals exploit the immense popularity of gaming.

You can read about this infostealer here: : https://flashpoint.io/blog/ageostealer-how-social-engineering-targets-gamers/.

Cloud Range and Cyviz Collaborate to Elevate Cybersecurity Curriculum in Higher Education through IBM’s Cyber Campus

Posted in Commentary with tags on April 22, 2025 by itnerd

Cloud Range, the industry’s leading cyber range solution, and Cyviz, a global leader in immersive collaboration technology, announced their initiative to enhance cybersecurity training within higher education institutions as partners for IBM’s Cyber Campus offering. Working together to deliver IBM’s Cyber Campus, Cloud Range, Cyviz, and IBM equip students with practical, hands-on experiential learning through an immersive, live-fire simulation platform—bridging the gap between academic knowledge and real-world job experience.

A dangerous shortage of cybersecurity workers in the United States puts digital privacy and the nation’s infrastructure at risk. ISC2’s 2024 Cybersecurity Workforce Study indicates a global cybersecurity workforce gap of 4.8 million, with a North American gap of 543,000, highlighting a stagnant workforce and a growing skills gap. This demand far outpaces supply, leaving 70% of businesses with open cybersecurity positions. With cybersecurity occupations projected to grow by 35% compared to 4% in other industries, the need for comprehensive, hands-on training has never been more critical. With IBM Cyber Campus, educational institutions can expand their investments in cybersecurity education and offer coursework that helps build the new cyber workforce with practical, hands-on experience.

Providing a risk-free, hands-on space to practice responding to real-world cyber threats, the IBM Cyber Campus, powered by Cloud Range and Cyviz, provides users across the U.S. with unparalleled access to advanced simulations and tools through a cutting-edge SaaS platform featuring specialized labs, live-fire exercises, and skill packs purpose-built for educational institutions. In addition, building a realistic Security Operations Center (SOC) environment provides individuals and teams an invaluable opportunity to develop, practice, and refine crucial human skills alongside technical expertise for effective cybersecurity operations. The flexibility of the IBM Cyber Campus experience ensures educational institutions can integrate comprehensive cybersecurity training into their curriculum without the need for extensive travel or infrastructure modifications.

To learn more about IBM’s Cyber Campus, visit: https://www.ibm.com/services/consulting-cyber-campus.

ASUS Discloses AiCloud Vulnerability And Says To Patch Your ASUS Routers NOW

Posted in Commentary with tags on April 22, 2025 by itnerd

People have often asked me why I am such an opponent of routers having the functionality of remote access. Well, this is why:

So basically, ASUS had an issue where if you had AICloud enabled on your ASUS router, someone could pwn you. But ASUS has released new firmware for a lot of their routers and fixed this. So all is fine now. Right?

Well, no it’s not. The thing is that when you open anything up to remote access via the Internet, you can get pwned. And a router is about the worst thing that you can open up remote access to. The reality is that nobody needs to remote access to their router. And I truly mean nobody. I for one have never utilized the on board remote access features of a router. And I have no plans on ever doing so as I would have to really trust the company that makes the gear that I am using. Which to be clear I do not have that level of trust in any company.

Next is the fact that while ASUS has fixed this, you know that threat actors will be figuring out if they can exploit this somehow. Whether it is via going after people who haven’t updating their firmware, or via finding an exploit that ASUS knows nothing about. Or both.

Finally, I have to give every consumer router company a free piece of advice. There zero need to include this functionality on your routers. It adds zero value and makes your products less secure. You would do yourself and the planet a favor by removing this functionality from your products.

In the meantime, ASUS router users should get about updating their firmware whether they use AICloud or not as there’s no harm in being as secure as you can be.

Today Is Earth Day

Posted in Commentary on April 22, 2025 by itnerd

Earth Day is an annual event on April 22 to demonstrate support for environmental protection. First held on April 22, 1970, it now includes a wide range of events coordinated globally through earthday.org. As Earth Day is today, I wanted to share some insights from leaders at Leaseweb CanadaCubic Transportation SystemsStorMagicContext Labs, and Leaseweb USA.  

Roger Brulotte, CEO, Leaseweb Canada 

“As companies around the world reflect on their environmental impact, it’s a good time to ask: how sustainable is your IT infrastructure? 

We believe Infrastructure as a Service (IaaS) isn’t just about performance and scalability—it’s also about responsibility. By consolidating workloads in high-efficiency data centers, powered increasingly by renewable energy, IaaS can help reduce your carbon footprint compared to on-premises infrastructure. 

Plus, smart usage means fewer idle servers, better resource allocation, and lower energy waste. 

Green IT isn’t a buzzword—it’s a strategic shift. On this Earth Day, let’s take a moment to recognize the role digital infrastructure plays in shaping a more sustainable future, supported by IaaS providers committed to helping businesses move toward more efficient, responsible cloud solutions. 

Let’s build a greener cloud together.” 

Nicole T. Brown, Vice President, Service Operations, Cubic Transportation Systems   

“As we celebrate Earth Day this year, it is important to remember that one of the most impactful ways we can contribute to the preservation of our planet is by being mindful of the environmental effects of our daily travel decisions. This can mean, whenever possible, opting to walk, cycle or utilize public transportation instead of driving alone in a car.   

However, this is not a responsibility that should be left up to individuals alone. State and local governments, as well as transit agencies, play an equally important role in funding, encouraging and creating easily accessible means of transportation. Typically, government funding favors roads rather than supporting infrastructure for mixed-use public transit. To encourage public transit as everyone’s first choice method of transportation, we need to be putting these funds towards providing shared, convenient, climate-friendly options for passengers that will ultimately help us protect our planet.” 

Maarten Odding, CFO, StorMagic 

“As Earth Day approaches on April 22, it’s crucial to recognize the growing pressure on companies to cut emissions and make IT infrastructure more sustainable. With more companies striving to achieve SBTi approval and reduce emissions, the need for effective, affordable, and energy-efficient solutions has never been greater. 

More companies are adopting increased climate accountability measures and reporting their own emissions, as well as those from their suppliers and customers. These companies prioritize working with suppliers who share their goals and sustainability commitments and are open about their progress. Some ways organizations can reduce their carbon footprint include: 

  • Increasing the use of renewable energy for direct energy requirements 
  • Reducing their infrastructure components, through platform consolidation, multi-tenancy, or virtualization 
  • Deploying power-efficient IT infrastructure components 
  • Reducing energy usage with software-defined storage 

With a growing focus on climate accountability, technology plays a central role in driving sustainability. As businesses align with climate science and set ambitious targets, there’s a shared responsibility to create solutions that reduce environmental impact and accelerate the transition to a low-carbon economy.” 

Dan Harple, CEO, Context Labs  

“To commemorate Earth Day, we must commit to properly addressing the pressing issue of methane emissions across the global energy supply chain. Methane, a potent greenhouse gas, has over 80 times the heat-trapping potential of carbon dioxide over a 20-year period. In a global economy that is 80% powered by traditional hydrocarbon energy sources, it remains crucial to have a precise understanding of where and how methane emissions are occurring. Eliminating leaks from oil, gas, and coal production, as well as during transport and distribution, can significantly contribute to climate change mitigation efforts.   

On this Earth Day, let us embrace the advancements in technology and support the energy industry to properly address methane emissions. By embracing innovative solutions, we can collectively work towards a more sustainable and decarbonized future, contributing to the global effort to decelerate climate change and protect the planet we live on.” 

Richard Copeland, CEO, Leaseweb USA 

“For leaders and decision-makers, keeping sustainability within operations and organizational core values as a focal point is imperative. Earth Day reminds everyone of our shared responsibility to protect the planet, but it’s crucial that sustainable practices remain a priority year-round. 

Organizations can limit their carbon footprint through the right IaaS provider. Computing, storage, and networking are huge energy consumers and contribute negatively to the environment. However, with the right IaaS partner that works with sustainability in mind, companies can rest assured that their resource-heavy operations are being properly managed within energy-efficient environments.  

This Earth Day, I would encourage decision-makers to look under the hood of their IT operations and consider how partnering with a responsible IaaS provider can help them meet their sustainability goals without compromising capabilities, security, and/or performance.” update

UPDATE: Freddy Kuo, Chairman, Luminys adds this:

“Sustainable energy isn’t just a goal—it’s essential for the future to reshape how the industries we serve protect critical environments and operate smarter and safer systems with connected technologies. The importance of reliable, eco-friendly power and intelligent monitoring systems is becoming more and more clear. These solutions are foundational to the success of delivering more connected and sustainable ecosystems globally and optimizing security integration with integrity.

Earth Day is a timely reminder that innovation needs to align with environmental obligation. The technologies we design today will define the impact we have tomorrow. Guided by efficiency, resilience, and sustainability, we can empower communities to support a future where built environments not only drive performance but also protect the planet.

The intersection of technology and sustainability is not just an opportunity—it’s a responsibility.”

More than 1 Billion AI Agents Spawn a Vast New Cyber Attack Surface: SandboxAQ Launches new platform to address the threat 

Posted in Commentary with tags on April 22, 2025 by itnerd

SandboxAQ today announced the general availability of AQtive Guard, a groundbreaking platform designed to manage and secure Non-Human Identities (NHIs) and other cryptographic assets used by AI agents – both friendly and malevolent – that are surging across enterprise environments.

As billions of AI agents flood enterprise ecosystems, organizations are facing an unprecedented surge of intelligent, adaptive cyber threats capable of continuously probing networks, evading detection, and rapidly exploiting vulnerabilities. This escalating threat demands proactive, AI-driven cryptographic defenses to counteract attacks that evolve faster than traditional security measures can respond.

AQtive Guard’s Discover module enables organizations to maintain an accurate inventory and control over both NHIs and cryptographic assets such as keys, certificates, algorithms, and libraries, and is crucial for compliance and meeting regulatory mandates. AQtive Guard’s Protect orchestrates automated remediation workflows and enforces protection policies such as credential rotation or certificate renewal.

Leveraging its industry-leading Large Quantitative Models (LQMs), AQtive Guard’s Discover and Protect modules provide organizations with unprecedented visibility, control and remediation, addressing the escalating challenges of machine-to-machine communication security, compliance pressures, and the transition to the new NIST security standards.

As part of the launch, SandboxAQ also announced two key capabilities:

  • Robust integration with the CrowdStrike Falcon® cybersecurity platform, representing SandboxAQ’s deepest technical integration to date. AQtive Guard empowers joint customers with full visibility into their non-human identity and cryptographic inventories and vulnerabilities by pulling data directly from CrowdStrike endpoints. One-click ingestion translates to value from the first hour of use. AQtive Guard can then remediate the vulnerabilities as they are identified.  
  • Interoperability with Palo Alto Networks, a trusted name in enterprise security solutions. SandboxAQ is ingesting Palo Alto Networks’ firewall logs directly into AQtive Guard, resulting in key visibility improvements for network security posture, vulnerability detection, and security compliance.

AQtive Guard addresses these challenges by providing a unified, AI-driven solution for modern NHI and cryptography management. The platform offers:

  • Vulnerability Detection and Inventory: Builds a complete and continuously updated inventory by integrating data from multiple sources, including existing data and meta-information captured from existing cybersecurity platforms and configuration management database tools. AQtive Guard works across the leading cloud providers including Amazon Web Services (AWS) and Google Cloud (GCP). This unified global inventory forms the crucial foundation for LQM analysis.
  • AI-powered Insights, Prioritization and Risk Analysis: Applies SandboxAQ’s industry-leading Cyber LQM to the unified inventory. By leveraging meta-data for advanced filtering and clustering, the platform enables efficient, noiseless exploration and accurate root-cause analysis, and delivers prioritized, actionable insights with contextual guidance for remediation and risk reduction, effectively reducing false positives. An integrated GenAI assistant further supports teams in understanding how to navigate relevant standards and regulatory frameworks.
  • Automated Remediation and Lifecycle Management: Streamlines and automates the entire lifecycle of identities and cryptographic keys – including issuance, rotation, and revocation – reducing manual overhead and minimizing the risk associated with stale or compromised secrets.
  • Compliance and NIST Standards: Provides targeted remediation recommendations, a powerful query engine with pre-built rulesets for major compliance standards (and custom query capabilities), and robust reporting to demonstrate compliance and significantly accelerate migration to new NIST standards.

Priority Access Starts Today: AQtive Guard launches today as a fully managed, cloud-delivered platform built for rapid deployment and immediate impact in securing cryptographic assets and nonhuman identities. Organizations can secure priority access today for early deployment and risk assessments. Take control at aqtiveguard.com or contact sales@sandboxaq.com.

Email Remains Primary Gateway for Disinformation and Cyberattacks in 2025 According to New Report from Valimail 

Posted in Commentary with tags on April 22, 2025 by itnerd

Valimail today released its “2025 Disinformation and Malicious Email Report,” revealing that email continues to be the most exploited attack vector for cybercriminals and disinformation campaigns, with artificial intelligence dramatically increasing the sophistication of these threats.

In an era marked widespread disinformation, trust in digital communications is eroding. Malicious actors are increasingly exploiting email to impersonate brands, launch phishing campaigns, and spread false information—often using sophisticated methods made simpler by emerging technologies. This environment calls for a layered approach to email protection. 

Email authentication is the foundational, cost-effective defense that can significantly curb many of these malicious attempts at their source, providing future-proof protection that can scale. Additionally, DMARC uniquely protects outbound email to partners and clients thereby offering brand and compliance protection.

The report reveals considerable variation in email authentication implementations across industries:

  • Online Retail leads with 94% of surveyed domains having implemented basic email authentication measures
  • Financial Services shows strong adoption (80%) but one-third of domains lack enforcement policies that actually prevent spoofing
  • Higher Education faces significant challenges with nearly two-thirds of domains unable to prevent impersonation attacks
  • Healthcare lags behind with just over one third having implemented the bare minimum, non-protective DMARC policy of p=none
  • Information Technology shows concerning gaps with nearly a third of surveyed domains lacking the ability to prevent the use of their domain name in spoofed email messages

Several alarming trends are highlighted within the report, including:

  • Rising threat sophistication: AI-generated emails more than ever now convincingly mimic legitimate communications, dramatically increasing the success rate of phishing and spoofing attacks.
  • Cross-industry vulnerability: Every sector from financial services to healthcare, government, and education faces significant email-based threats, with varying levels of preparedness.
  • Protection gap: While more than 7.2 million domains have implemented some form of email authentication, approximately half remain insufficiently protected against domain spoofing.

Despite these growing threats, the report shows that Domain-based Message Authentication, Reporting, and Conformance (DMARC) continues to be a highly effective approach that can authoritatively prevent the most pernicious spoofing attacks when properly implemented.

Industry, government, and regulatory bodies worldwide are increasingly mandating DMARC compliance for industries handling sensitive data, such as finance and healthcare. Major email providers like Google, Yahoo and Microsoft require email senders to implement DMARC, improving deliverability and reputation for compliant organizations. Failing to comply with DMARC mandates can result in penalties, reduced deliverability, and reputational damage.

Valimail offers free resources for organizations to check their email security status through the Valimail DMARC Checker and provides DMARC reporting visibility through its Monitor solution.

The full “2025 Disinformation and Malicious Email Report” can be accessed here.

Microsoft Entra Account Lockouts Caused by User Token Logging Mistake

Posted in Commentary with tags on April 22, 2025 by itnerd

From the “Oops” department comes this story. Microsoft has reported that the Entra accounts that were locked out over the weekend were caused by the invalidation of user refresh tokens that were mistakenly logged into internal systems.

More details here:  https://www.reddit.com/r/sysadmin/comments/1k2pmkz/comment/mo33q3f/

On Friday 4/18/25, Microsoft identified that it was internally logging a subset of short-lived user refresh tokens for a small percentage of users, whereas our standard logging process is to only log metadata about such tokens. The internal logging issue was immediately corrected, and the team performed a procedure to invalidate these tokens to protect customers.  As part of the invalidation process, we inadvertently generated alerts in Entra ID Protection indicating the user’s credentials may have been compromised. These alerts were sent between 4/20/25 4AM UTC and 4/20/25 9AM UTC. We have no indication of unauthorized access to these tokens – and if we determine there were any unauthorized access, we will invoke our standard security incident response and communication processes.  

Jim Routh, Chief Trust Officer at Saviynt, commented:

“It is not often that the identification of security vulnerabilities within a commonly used platform, which caused business disruption for some Microsoft enterprise customers, has some positive attributes for enterprises. The positive news is that the disruption occurred over the weekend, and today (Monday), customers have the facts along with the fix (corrective actions) necessary for recovery. The vulnerability and the action taken (token invalidation) were ultimately shared by Microsoft in an advisory relatively quickly. This is a sign of health or resilience despite the inconvenience to some enterprise customers over the weekend.”

I’ll give Microsoft credit for discovering this, fixing this, and admitting to it quickly. Hopefully something like this never happens again as this had the possibility of not ending well on multiple fronts.

New Research from Cloud Security Alliance Highlights Critical Need for a More Unified, Purpose-built Approach to SaaS Security

Posted in Commentary with tags on April 22, 2025 by itnerd

The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today released the State of SaaS Security Report: Trends and Insights for 2025-2026, which examines the current state of SaaS security to uncover key challenges and explore how organizations are securing and managing their SaaS environments. The findings underscore the urgency for organizations to shift their SaaS security to a more unified, purpose-built approach. Current approaches to SaaS security are not enough.

Commissioned by Valence Security, the leader in SaaS security, the survey set out to determine the current state of SaaS security, uncover key challenges, and explore how organizations are securing and managing their SaaS environments.

SaaS security strategies cannot keep pace with the growing complexity of the SaaS landscape, remaining fragmented, reactive, and incomplete. Despite heightened awareness of the critical need for strong SaaS security, organizations must move beyond ad hoc, app-by-app controls to close the gap between rising investments and actual capabilities—adopting a more unified approach that addresses core challenges like discovery, posture management, threat detection, and risk remediation.

The report’s key findings include:

  • SaaS security is a top priority for 86% of organizations, with 76% of respondents saying they are increasing their budgets this year.
  • Despite organizations committing more resources to SaaS security, data oversharing (63%) and poor access control (56%) continue to expose them to risk, suggesting that many are still unable to establish the fundamental protections needed to secure sensitive data across their environments.
  • 79% of organizations expressed confidence in their programs. This high confidence level may be masking critical capability gaps with 55% of respondents sharing that employees are adopting SaaS tools without security’s involvement and 57% reporting they are grappling with fragmented SaaS security administration.
  • IAM remains a challenge. 58% of respondents said enforcing proper privilege levels was difficult, and 54% lacked automation for lifecycle management—gaps which directly contribute to breaches, complicate incident response, and leave organizations exposed.
  • SaaS-to-SaaS integrations and GenAI tools are expanding the attack surface, leaving nearly half of organizations (46%) struggling to monitor non-human identities (NHIs) and 56% concerned with over-privileged API access.
  • Too many organizations are relying on fragmented strategies, such as vendor-native tools (69%), general-purpose solutions like Cloud Access Security Brokers (CASBs) (43%), and manual audits (46%), resulting in critical gaps across the SaaS environment that will only widen as these systems become more complex.

The survey was conducted online by CSA in January 2025 and received 420 responses from IT and security professionals representing large organizations in various industries and locations. CSA’s research analysts performed the data analysis and interpretation for this report. Sponsors are CSA Corporate Members who support the research project’s findings but have no added influence on the content development or editing rights of CSA research.

Review the full State of SaaS Security Report: Trends and Insights for 2025-2026.