Ransomware as a Service (RaaS) Threats
This blog post explores the economics behind why ransomware remains a top tool for cybercrime and presents the current active…
Snake Ransomware Analysis Updates
In January 2020, Sentinel Labs published two reports on Snake (also known as Ekans) ransomware.[1][2] The Snake ransomware gained attention…
Bridging the Gap Between Research and Practice
A fundamental goal for a federally funded research and development center (FFRDC) is to bridge the gap between research and…
Security Automation Begins at the Source Code
Hi, this is Vijay Sarvepalli, Information Security Architect in the CERT Division. On what seemed like a normal day at…
Comments on NIST IR 8269: A Taxonomy and Terminology of Adversarial Machine Learning
The U.S. National Institute of Standards and Technology (NIST) recently held a public comment period on their draft report on…
Prioritizing Vulnerability Response with a Stakeholder-Specific Vulnerability Categorization
We’ve just released a follow-up paper in our research agenda about prioritizing actions during vulnerability management, Prioritizing Vulnerability Response: A…
Machine Learning in Cybersecurity
Our technical report provides an overview of the relevant parts of an ML lifecycle–selecting the right problem, the right data,…
VPN – A Gateway for Vulnerabilities
Virtual Private Networks (VPNs) are the backbone of today’s businesses providing a wide range of entities from remote employees to…
It’s Time to Retire Your Unsupported Things
“If it ain’t broke, don’t fix it.” Why mess with something that already works? This is fair advice with many…
Update on the CERT Guide to Coordinated Vulnerability Disclosure
It’s been two years since we originally published the CERT Guide to Coordinated Vulnerability Disclosure. In that time, it’s influenced…