Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
How to Submit a Column to Dark Reading
7 Security Strategies as Employees Return to the Office
Inside the Ransomware Campaigns Targeting Exchange Servers
4 Open Source Tools to Add to Your Security Arsenal
News & Commentary
Pandemic Drives Greater Need for Endpoint Security
Dark Reading Staff, Quick Hits
Endpoint security has changed. Can your security plan keep up?
By Dark Reading Staff , 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
High-Level Admin of FIN7 Cybercrime Group Sentenced to 10 Years in Prison
Dark Reading Staff, Quick Hits
Fedir Hladyr pleaded guilty in 2019 to conspiracy to commit wire fraud and conspiracy to commit computer hacking.
By Dark Reading Staff , 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
Security Gaps in IoT Access Control Threaten Devices and Users
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers spot problems in how IoT vendors delegate device access across multiple clouds and users.
By Kelly Sheridan Staff Editor, Dark Reading, 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
How the Biden Administration Can Make Digital Identity a Reality
Hal Granoff, Head of US Market Development at CallsignCommentary
A digital identity framework is the answer to the US government's cybersecurity dilemma.
By Hal Granoff Head of US Market Development at Callsign, 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
Software Developer Arrested in Computer Sabotage Case
Dark Reading Staff, Quick Hits
Officials say Davis Lu placed malicious code on servers in a denial-of-service attack on his employer.
By Dark Reading Staff , 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Google Brings 37 Security Fixes to Chrome 90
Dark Reading Staff, Quick Hits
The latest version of Google Chrome also introduces HTTPS as the browser's default protocol.
By Dark Reading Staff , 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing WriterNews
Treasury Department slaps sanctions on IT security firms that it says supported Russia's Foreign Intelligence Service carry out the attacks.
By Jai Vijayan Contributing Writer, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Pandemic Pushes Bot Operators to Redirect Efforts
Robert Lemos, Contributing WriterNews
As demand for travel, lodging, and concerts plummeted in 2020, bot traffic moved to more popular activities, such as e-commerce, healthcare, and government sites.
By Robert Lemos Contributing Writer, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
6 Tips for Managing Operational Risk in a Downturn
Steve Durbin, CEO of the Information Security ForumCommentary
Many organizations adjust their risk appetite in an economic downturn, as risk is expanded to include supplier and customer insolvency, not to mention cash-flow changes.
By Steve Durbin CEO of the Information Security Forum, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
How to Create an Incident Response Plan From the Ground Up
Eric Ahlm, Senior Research Director, Gartner
Security 101: In the wake of an incident, it's important to cover all your bases -- and treat your IR plan as a constantly evolving work in progress.
By Eric Ahlm Senior Research Director, Gartner, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Nation-State Attacks Force a New Paradigm: Patching as Incident Response
Fred Langston, Executive Vice President of Professional Services and Co-Founder, CI SecurityCommentary
IT no longer has the luxury of thoroughly testing critical vulnerability patches before rolling them out.
By Fred Langston Executive Vice President of Professional Services and Co-Founder, CI Security, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Malicious PowerShell Use, Attacks on Office 365 Accounts Surged in Q4
Jai Vijayan, Contributing WriterNews
There was also a sharp increase in overall malware volumes in the fourth quarter of 2020, COVID-19 related attack activity, and mobile malware, new data shows.
By Jai Vijayan Contributing Writer, 4/15/2021
Comment1 Comment  |  Read  |  Post a Comment
Thycotic & Centrify Merge to Form Cloud Identity Security Firm
Dark Reading Staff, Quick Hits
The combined entity will expand on both companies' privileged access management tools and expects to debut a new brand this year.
By Dark Reading Staff , 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
CISA Urges Caution for Security Researchers Targeted in Attack Campaign
Dark Reading Staff, Quick Hits
The agency urges researchers to take precautions amid an ongoing targeted threat campaign.
By Dark Reading Staff , 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark ReadingNews
A court order authorized the FBI to remove malicious Web shells from hundreds of vulnerable machines running on-premises Exchange Server.
By Kelly Sheridan Staff Editor, Dark Reading, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
The CISO Life Is Half as Good
Sara Peters, Senior Editor at Dark Reading
Lora Vaughn was at a crossroads -- and that was before mandated pandemic lockdowns came into play. Here's her story of how life got sweeter after she stepped away from the CISO job.
By Sara Peters Senior Editor at Dark Reading, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Bolstering Our Nation's Defenses Against Cybersecurity Attacks
Shawn Henry, CrowdStrike president of services and CSOCommentary
Shawn Henry, former Executive Assistant Director of the FBI and current CrowdStrike president of services and CSO, shares the top three cybersecurity priorities that the Biden administration needs to address.
By Shawn Henry CrowdStrike president of services and CSO, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing WriterNews
The number of components in the average application rose 77% over two years. No wonder, then, that 84% of codebases have at least one vulnerability.
By Robert Lemos Contributing Writer, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack
Jai Vijayan, Contributing WriterNews
Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.
By Jai Vijayan Contributing Writer, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
NSA Alerted Microsoft to New Exchange Server Vulnerabilities
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft today patched 114 CVEs to address the Exchange Server flaws, more than 50 remote code execution vulnerabilities, and one zero-day.
By Kelly Sheridan Staff Editor, Dark Reading, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
Kasada and GreyNoise Team up to Identify Which Potential Threats Demand Immediate Attention
$125M Growth Round Fuels Keyfactor & PrimeKey Merger to Bring Machine Identity Management to the Mainstream
Cado Security Closes $10M in Funding to Accelerate Adoption of Cloud-Native Digital Forensics Platform
Vital Pandemic Industries Foster Unprecedented DDoS Attack Activity, NETSCOUT Threat Intelligence Report Finds
1Password Launches Secrets Automation & Makes Acquisition to Protect Infrastructure Secrets
Invicti Security Reports on Lost Year in Web Application Security
New Kaspersky Endpoint Security Cloud Upgraded With EDR for Small & Medium Businesses
SafeGuard Cyber Raises $45M In Strategic Growth Financing Led By NightDragon
More Products & Releases
PR Newswire
Dark Reading Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the Dark Reading site in the coming months.

How to Create an Incident Response Plan From the Ground Up
Security 101: In the wake of an incident, it's important to cover all your bases -- and treat your IR plan as a constantly evolving work in progress.
The CISO Life Is Half as Good
Lora Vaughn was at a crossroads -- and that was before mandated pandemic lockdowns came into play. Here's her story of how life got sweeter after she stepped away from the CISO job.
9 Modern-Day Best Practices for Log Management
Log management is nothing new. But doing so smartly, correctly, and concisely in today's data-driven world is another story.
Register for Dark Reading Newsletters
Cartoon
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9667
PUBLISHED: 2021-04-16
Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker could exploit this to to plant custom binaries and execute them with System permissions. Exploitation of this issue requires user interaction.
CVE-2020-9668
PUBLISHED: 2021-04-16
Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.
CVE-2020-9681
PUBLISHED: 2021-04-16
Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker could exploit this to rewrite the file of the administrator, which may lead to elevated permissions. Exploitation of this issue requires user interaction.
CVE-2021-26830
PUBLISHED: 2021-04-16
SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
CVE-2021-29443
PUBLISHED: 2021-04-16
jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be throw...
Flash Poll
Video
Slideshows
Twitter Feed