Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
The CISO Life Is Half as Good
8 Security & Privacy Apps to Share With Family and Friends
Global Dwell Time Drops as Ransomware Attacks Accelerate
5 Objectives for Establishing an API-First Security Strategy
News & Commentary
SolarWinds: A Catalyst for Change & a Cry for Collaboration
Kurt John, Chief Cybersecurity Officer, Siemens USACommentary
Cybersecurity is more than technology or safeguards like zero trust; mostly, it's about collaboration.
By Kurt John Chief Cybersecurity Officer, Siemens USA, 4/19/2021
Comment0 comments  |  Read  |  Post a Comment
Pandemic Drives Greater Need for Endpoint Security
Dark Reading Staff, Quick Hits
Endpoint security has changed. Can your security plan keep up?
By Dark Reading Staff , 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
High-Level Admin of FIN7 Cybercrime Group Sentenced to 10 Years in Prison
Dark Reading Staff, Quick Hits
Fedir Hladyr pleaded guilty in 2019 to conspiracy to commit wire fraud and conspiracy to commit computer hacking.
By Dark Reading Staff , 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
Security Gaps in IoT Access Control Threaten Devices and Users
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers spot problems in how IoT vendors delegate device access across multiple clouds and users.
By Kelly Sheridan Staff Editor, Dark Reading, 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
How the Biden Administration Can Make Digital Identity a Reality
Hal Granoff, Head of US Market Development at CallsignCommentary
A digital identity framework is the answer to the US government's cybersecurity dilemma.
By Hal Granoff Head of US Market Development at Callsign, 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
Software Developer Arrested in Computer Sabotage Case
Dark Reading Staff, Quick Hits
Officials say Davis Lu placed malicious code on servers in a denial-of-service attack on his employer.
By Dark Reading Staff , 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Google Brings 37 Security Fixes to Chrome 90
Dark Reading Staff, Quick Hits
The latest version of Google Chrome also introduces HTTPS as the browser's default protocol.
By Dark Reading Staff , 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing WriterNews
Treasury Department slaps sanctions on IT security firms that it says supported Russia's Foreign Intelligence Service carry out the attacks.
By Jai Vijayan Contributing Writer, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Pandemic Pushes Bot Operators to Redirect Efforts
Robert Lemos, Contributing WriterNews
As demand for travel, lodging, and concerts plummeted in 2020, bot traffic moved to more popular activities, such as e-commerce, healthcare, and government sites.
By Robert Lemos Contributing Writer, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
6 Tips for Managing Operational Risk in a Downturn
Steve Durbin, CEO of the Information Security ForumCommentary
Many organizations adjust their risk appetite in an economic downturn, as risk is expanded to include supplier and customer insolvency, not to mention cash-flow changes.
By Steve Durbin CEO of the Information Security Forum, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
How to Create an Incident Response Plan From the Ground Up
Eric Ahlm, Senior Research Director, Gartner
Security 101: In the wake of an incident, it's important to cover all your bases -- and treat your IR plan as a constantly evolving work in progress.
By Eric Ahlm Senior Research Director, Gartner, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Nation-State Attacks Force a New Paradigm: Patching as Incident Response
Fred Langston, Executive Vice President of Professional Services and Co-Founder, CI SecurityCommentary
IT no longer has the luxury of thoroughly testing critical vulnerability patches before rolling them out.
By Fred Langston Executive Vice President of Professional Services and Co-Founder, CI Security, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Malicious PowerShell Use, Attacks on Office 365 Accounts Surged in Q4
Jai Vijayan, Contributing WriterNews
There was also a sharp increase in overall malware volumes in the fourth quarter of 2020, COVID-19 related attack activity, and mobile malware, new data shows.
By Jai Vijayan Contributing Writer, 4/15/2021
Comment1 Comment  |  Read  |  Post a Comment
Thycotic & Centrify Merge to Form Cloud Identity Security Firm
Dark Reading Staff, Quick Hits
The combined entity will expand on both companies' privileged access management tools and expects to debut a new brand this year.
By Dark Reading Staff , 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
CISA Urges Caution for Security Researchers Targeted in Attack Campaign
Dark Reading Staff, Quick Hits
The agency urges researchers to take precautions amid an ongoing targeted threat campaign.
By Dark Reading Staff , 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark ReadingNews
A court order authorized the FBI to remove malicious Web shells from hundreds of vulnerable machines running on-premises Exchange Server.
By Kelly Sheridan Staff Editor, Dark Reading, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
The CISO Life Is Half as Good
Sara Peters, Senior Editor at Dark Reading
Lora Vaughn was at a crossroads -- and that was before mandated pandemic lockdowns came into play. Here's her story of how life got sweeter after she stepped away from the CISO job.
By Sara Peters Senior Editor at Dark Reading, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Bolstering Our Nation's Defenses Against Cybersecurity Attacks
Shawn Henry, CrowdStrike president of services and CSOCommentary
Shawn Henry, former Executive Assistant Director of the FBI and current CrowdStrike president of services and CSO, shares the top three cybersecurity priorities that the Biden administration needs to address.
By Shawn Henry CrowdStrike president of services and CSO, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing WriterNews
The number of components in the average application rose 77% over two years. No wonder, then, that 84% of codebases have at least one vulnerability.
By Robert Lemos Contributing Writer, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack
Jai Vijayan, Contributing WriterNews
Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.
By Jai Vijayan Contributing Writer, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
Mastercard to Acquire Ekata to Advance Digital Identity Efforts
Kasada and GreyNoise Team up to Identify Which Potential Threats Demand Immediate Attention
$125M Growth Round Fuels Keyfactor & PrimeKey Merger to Bring Machine Identity Management to the Mainstream
Cado Security Closes $10M in Funding to Accelerate Adoption of Cloud-Native Digital Forensics Platform
Vital Pandemic Industries Foster Unprecedented DDoS Attack Activity, NETSCOUT Threat Intelligence Report Finds
1Password Launches Secrets Automation & Makes Acquisition to Protect Infrastructure Secrets
Invicti Security Reports on Lost Year in Web Application Security
New Kaspersky Endpoint Security Cloud Upgraded With EDR for Small & Medium Businesses
More Products & Releases
PR Newswire
Dark Reading Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the Dark Reading site in the coming months.

How to Create an Incident Response Plan From the Ground Up
Security 101: In the wake of an incident, it's important to cover all your bases -- and treat your IR plan as a constantly evolving work in progress.
The CISO Life Is Half as Good
Lora Vaughn was at a crossroads -- and that was before mandated pandemic lockdowns came into play. Here's her story of how life got sweeter after she stepped away from the CISO job.
9 Modern-Day Best Practices for Log Management
Log management is nothing new. But doing so smartly, correctly, and concisely in today's data-driven world is another story.
Register for Dark Reading Newsletters
Cartoon
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21981
PUBLISHED: 2021-04-19
VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment. Successful exploitation of this issue may allow attackers with local guest user account to assign privileges higher than their own permission level.
CVE-2021-20989
PUBLISHED: 2021-04-19
Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be us...
CVE-2021-20990
PUBLISHED: 2021-04-19
In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode.
CVE-2021-20991
PUBLISHED: 2021-04-19
In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability.
CVE-2021-20992
PUBLISHED: 2021-04-19
In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords.
Flash Poll
Video
Slideshows
Twitter Feed