Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
The CISO Life Is Half as Good
8 Security & Privacy Apps to Share With Family and Friends
Global Dwell Time Drops as Ransomware Attacks Accelerate
5 Objectives for Establishing an API-First Security Strategy
News & Commentary
Business Email Compromise Costs Businesses More Than Ransomware
Charlie Winckless, Senior Director, Cybersecurity Solutions, at PresidioCommentary
Ransomware gets the headlines, but business paid out $1.8 billion last year to resolve BEC issues, according to an FBI report.
By Charlie Winckless Senior Director, Cybersecurity Solutions, at Presidio, 4/21/2021
Comment0 comments  |  Read  |  Post a Comment
How to Attack Yourself Better in 2021
Pavel Suprunyuk, Technical lead of the audit and consulting team, Group-IBCommentary
Social engineering pen testing is just one step in preventing employees from falling victim to cybercriminals.
By Pavel Suprunyuk Technical lead of the audit and consulting team, Group-IB, 4/21/2021
Comment0 comments  |  Read  |  Post a Comment
Attackers Heavily Targeting VPN Vulnerabilities
Jai Vijayan, Contributing WriterNews
Threat actors like attacking the technology because they provide a convenient entry point to enterprise networks.
By Jai Vijayan Contributing Writer, 4/21/2021
Comment0 comments  |  Read  |  Post a Comment
Pulse Secure VPN Flaws Exploited to Target US Defense Sector
Kelly Sheridan, Staff Editor, Dark ReadingNews
China-linked attackers have used vulnerabilities in the Pulse Secure VPN appliance to attack US Defense Industrial Base networks.
By Kelly Sheridan Staff Editor, Dark Reading, 4/20/2021
Comment0 comments  |  Read  |  Post a Comment
Foreign Spies Target British Nationals With Fake Social Media Profiles
Dark Reading Staff, Quick Hits
British security agency MI5 has launched a new education campaign to warn potential victims of the attacks.
By Dark Reading Staff , 4/20/2021
Comment0 comments  |  Read  |  Post a Comment
Attackers Compromised Code-Checking Vendor's Tool for Two Months
Robert Lemos, Contributing WriterNews
A script used to upload sensitive reports—with access to credentials and datastores—likely sent information on hundreds, possibly thousands, of companies to attackers.
By Robert Lemos Contributing Writer, 4/20/2021
Comment0 comments  |  Read  |  Post a Comment
Dept. of Energy Launches Plan to Protect Electric Grid from Cyberattack
Dark Reading Staff, Quick Hits
Over the next 100 days, the DoE will work with electric utilities to improve visibility, detection, and response for industrial control systems.
By Dark Reading Staff , 4/20/2021
Comment0 comments  |  Read  |  Post a Comment
2020 Changed Identity Forever; What's Next?
Arthur Coviello, Venture partner at Rally Ventures, LLC and former executive chairman RSA SecurityCommentary
For all the chaos the pandemic caused, it also sparked awareness of how important an identity-centric approach is to securing today's organizations.
By Arthur Coviello Venture partner at Rally Ventures, LLC and former executive chairman RSA Security, 4/20/2021
Comment0 comments  |  Read  |  Post a Comment
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Contributing Writer
Beneath all those containers and IoT devices, there's a rich patchwork of gear, protocols, and guidelines that have been holding it together since before you were born. Knowledge of those fundamentals is growing more valuable, not less.
By Joan Goodchild Contributing Writer, 4/20/2021
Comment0 comments  |  Read  |  Post a Comment
Beware the Bug Bounty
Joseph Neumann & Doug Hudson, Cyber Executive Advisor / Senior Director, CoalfireCommentary
In recent months, bug-bounty programs have shifted from mitigating risk to inadvertently creating new liabilities for customers and vendors.
By Joseph Neumann & Doug Hudson Cyber Executive Advisor / Senior Director, Coalfire, 4/20/2021
Comment0 comments  |  Read  |  Post a Comment
White House Scales Back Response to SolarWinds & Exchange Server Attacks
Jai Vijayan, Contributing WriterNews
Lessons learned from the Unified Coordination Groups will be used to inform future response efforts, a government official says.
By Jai Vijayan Contributing Writer, 4/19/2021
Comment0 comments  |  Read  |  Post a Comment
Attackers Test Weak Passwords in Purple Fox Malware Attacks
Dark Reading Staff, Quick Hits
Researchers share a list of passwords that Purple Fox attackers commonly brute force when targeting the SMB protocol.
By Dark Reading Staff , 4/19/2021
Comment1 Comment  |  Read  |  Post a Comment
Lazarus Group Uses New Tactic to Evade Detection
Dark Reading Staff, Quick Hits
Attackers conceal malicious code within a BMP file to slip past security tools designed to detect embedded objects within images.
By Dark Reading Staff , 4/19/2021
Comment0 comments  |  Read  |  Post a Comment
SolarWinds: A Catalyst for Change & a Cry for Collaboration
Kurt John, Chief Cybersecurity Officer, Siemens USACommentary
Cybersecurity is more than technology or safeguards like zero trust; mostly, it's about collaboration.
By Kurt John Chief Cybersecurity Officer, Siemens USA, 4/19/2021
Comment0 comments  |  Read  |  Post a Comment
Pandemic Drives Greater Need for Endpoint Security
Dark Reading Staff, Quick Hits
Endpoint security has changed. Can your security plan keep up?
By Dark Reading Staff , 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
High-Level Admin of FIN7 Cybercrime Group Sentenced to 10 Years in Prison
Dark Reading Staff, Quick Hits
Fedir Hladyr pleaded guilty in 2019 to conspiracy to commit wire fraud and conspiracy to commit computer hacking.
By Dark Reading Staff , 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
Security Gaps in IoT Access Control Threaten Devices and Users
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers spot problems in how IoT vendors delegate device access across multiple clouds and users.
By Kelly Sheridan Staff Editor, Dark Reading, 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
How the Biden Administration Can Make Digital Identity a Reality
Hal Granoff, Head of US Market Development at CallsignCommentary
A digital identity framework is the answer to the US government's cybersecurity dilemma.
By Hal Granoff Head of US Market Development at Callsign, 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
Software Developer Arrested in Computer Sabotage Case
Dark Reading Staff, Quick Hits
Officials say Davis Lu placed malicious code on servers in a denial-of-service attack on his employer.
By Dark Reading Staff , 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Google Brings 37 Security Fixes to Chrome 90
Dark Reading Staff, Quick Hits
The latest version of Google Chrome also introduces HTTPS as the browser's default protocol.
By Dark Reading Staff , 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
Cynet Activates Competitive Replacement Program for Customers Migrating to Cynet 360 XDR Platform
Sift Streamlines Digital Trust & Safety Suite to Protect Merchants Against the Fraud Economy
MITRE Engenuity Announces Results from Evaluating Enterprise Security Products Against Cybercrime Threats
Zerto Announces Zerto Backup for SaaS, Powered by Keepit
Zerto Announces General Availability of Zerto for Kubernetes and New Public Cloud Capabilities
Zscaler Advances Zero Trust Security for the Digital Business
Mastercard to Acquire Ekata to Advance Digital Identity Efforts
Kasada and GreyNoise Team up to Identify Which Potential Threats Demand Immediate Attention
More Products & Releases
PR Newswire
Dark Reading Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the Dark Reading site in the coming months.

7 Old IT Things Every New InfoSec Pro Should Know
Beneath all those containers and IoT devices, there's a rich patchwork of gear, protocols, and guidelines that have been holding it together since before you were born. Knowledge of those fundamentals is growing more valuable, not less.
How to Create an Incident Response Plan From the Ground Up
Security 101: In the wake of an incident, it's important to cover all your bases -- and treat your IR plan as a constantly evolving work in progress.
The CISO Life Is Half as Good
Lora Vaughn was at a crossroads -- and that was before mandated pandemic lockdowns came into play. Here's her story of how life got sweeter after she stepped away from the CISO job.
Register for Dark Reading Newsletters
Cartoon
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7856
PUBLISHED: 2021-04-20
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation.
CVE-2021-28793
PUBLISHED: 2021-04-20
vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.
CVE-2021-25679
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed....
CVE-2021-25680
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only...
CVE-2021-25681
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The aff...
Flash Poll
Video
Slideshows
Twitter Feed