Skip to content
English - United States

Cybersecurity Insights with Contrast CISO David Lindner | 03/07/25

By David Lindner, Chief Information Security Officer

March 7, 2025

vulnerabilities Security cybersecurity MFA ransomware KEV catalog open source codebase patching conditional access

    
Cybersecurity Insights with Contrast CISO David Lindner

Insight No. 1. — Ransomware groups are using CISA’s KEV catalog as a runbook 

Given that CISA's Known Exploited Vulnerabilities (KEV) catalog highlights the most actively exploited and critical Common Vulnerabilities and Exposures (CVEs), it's no surprise ransomware groups are targeting them. Organizations must recognize this obvious threat: If CISA flags it, attackers are using it. Prioritize patching these vulnerabilities immediately — it's time to "fix your stuff" and secure your systems.

Insight No. 2. — Does your open-source codebase taste rancid to you? It should. 

Picture a chef strutting out with a fancy dish, only to admit it’s laced with ingredients that went bad years ago — yikes! Well, per the latest report, 86% of codebases are packed with vulnerable open-source components like some kind of moldy buffet. Even more nauseating? 81% of those components have high or critical risks, yet devs are dishing out apps, pretending they’ve built a nutritious, delicious, secure digital fortress. Meanwhile, the side gate’s swinging in the breeze. Some of these open-source components haven’t been updated in over four years because, apparently, patching code is less thrilling than a late-night bug hunt. Want to dodge the next big breach? Treat your codebase like your refrigerator: Sniff out the stale junk and compost it before it poisons your business or your customer’s business. 

Insight No. 3. — Mandatory MFA? Marvelous!

Don’t like Microsoft shoving its Entra ID P2 mandatory conditional access policies license down your throat? Well, buckle up, Buttercup, because "optional" is officially kicking rocks when it comes to multifactor authentication (MFA). Think of it like this: Your data is a delicious, unattended pizza, and the internet is a ravenous horde of raccoons. You could leave the door open and hope they're all suddenly vegan, or you could slam that digital deadbolt shut with MFA. Seriously, if your password is "password123" (and let's be honest, statistically, it might be), MFA is the difference between a minor identity theft hiccup and your entire online life being used to order novelty socks in bulk. So get it done, or you'll be explaining to your boss why "I thought a 12-character password was enough" just isn't cutting it anymore.
vulnerabilities Security cybersecurity MFA ransomware KEV catalog open source codebase patching conditional access
David Lindner, Chief Information Security Officer

David Lindner, Chief Information Security Officer

David is an experienced application security professional with over 20 years in cybersecurity. In addition to serving as the chief information security officer, David leads the Contrast Labs team that is focused on analyzing threat intelligence to help enterprise clients develop more proactive approaches to their application security programs. Throughout his career, David has worked within multiple disciplines in the security field—from application development, to network architecture design and support, to IT security and consulting, to security training, to application security. Over the past decade, David has specialized in all things related to mobile applications and securing them. He has worked with many clients across industry sectors, including financial, government, automobile, healthcare, and retail. David is an active participant in numerous bug bounty programs.

Previous

Enhancing Application Security with Contrast ADR and Splunk