Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

News & Commentary
Google Brings 37 Security Fixes to Chrome 90
Dark Reading Staff, Quick Hits
The latest version of Google Chrome also introduces HTTPS as the browser's default protocol.
By Dark Reading Staff , 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
6 Tips for Managing Operational Risk in a Downturn
Steve Durbin, CEO of the Information Security ForumCommentary
Many organizations adjust their risk appetite in an economic downturn, as risk is expanded to include supplier and customer insolvency, not to mention cash-flow changes.
By Steve Durbin CEO of the Information Security Forum, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
Nation-State Attacks Force a New Paradigm: Patching as Incident Response
Fred Langston, Executive Vice President of Professional Services and Co-Founder, CI SecurityCommentary
IT no longer has the luxury of thoroughly testing critical vulnerability patches before rolling them out.
By Fred Langston Executive Vice President of Professional Services and Co-Founder, CI Security, 4/15/2021
Comment0 comments  |  Read  |  Post a Comment
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark ReadingNews
A court order authorized the FBI to remove malicious Web shells from hundreds of vulnerable machines running on-premises Exchange Server.
By Kelly Sheridan Staff Editor, Dark Reading, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Bolstering Our Nation's Defenses Against Cybersecurity Attacks
Shawn Henry, CrowdStrike president of services and CSOCommentary
Shawn Henry, former Executive Assistant Director of the FBI and current CrowdStrike president of services and CSO, shares the top three cybersecurity priorities that the Biden administration needs to address.
By Shawn Henry CrowdStrike president of services and CSO, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Clear & Present Danger: Data Hoarding Undermines Better Security
Elissa M. Redmiles, Researcher, Max Planck Institute for Software SystemsCommentary
Facebook and Google can identify patterns of attack within their own data, but smaller businesses rarely see enough traffic to successfully identify an attack or warn users.
By Elissa M. Redmiles Researcher, Max Planck Institute for Software Systems, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Biden Nominates Former NSA Officials for Top Cybersecurity Roles
Kelly Sheridan, Staff Editor, Dark ReadingNews
President Biden has nominated Jen Easterly as the new director of CISA and is expected to nominate Chris Inglis as the first national cyber director.
By Kelly Sheridan Staff Editor, Dark Reading, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Warns of Malware Delivery via Google URLs
Dark Reading Staff, Quick Hits
A new campaign abuses legitimate website contact forms to send URLs that ultimately deliver the IcedID banking Trojan.
By Dark Reading Staff , 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Federal Reserve Chairman Says Cyber-Risk a Top Threat to National Economy
Dark Reading Staff, Quick Hits
Jerome Powell tells 60 Minutes that cyberattacks have the potential to do major damage to US financial system.
By Dark Reading Staff , 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Wake Up and Smell the JavaScript
Deepika Gajaria, VP of Products, Tala SecurityCommentary
The SolarWinds attack showed the true meaning of a supply chain breach. And it's the canary in the coal mine for sensitive data on the Web.
By Deepika Gajaria VP of Products, Tala Security, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Unofficial Android App Store APKPure Infected With Malware
Dark Reading Staff, Quick Hits
The APKPure app store was infected with malware that can download Trojans to other Android devices, researchers report.
By Dark Reading Staff , 4/9/2021
Comment0 comments  |  Read  |  Post a Comment
CISA Launches New Threat Detection Dashboard
Dark Reading Staff, Quick Hits
Aviary is a new dashboard that works with CISA's Sparrow threat detection tool.
By Dark Reading Staff , 4/9/2021
Comment0 comments  |  Read  |  Post a Comment
8 Security & Privacy Apps to Share With Family and Friends
Kelly Sheridan, Staff Editor, Dark Reading
Mobile apps to recommend to the people in your life who want to improve their online security and privacy.
By Kelly Sheridan Staff Editor, Dark Reading, 4/9/2021
Comment0 comments  |  Read  |  Post a Comment
Fraudsters Use HTML Legos to Evade Detection in Phishing Attack
Dark Reading Staff, Quick Hits
Criminals stitch pieces of HTML together and hide them in JavaScript files, researchers report.
By Dark Reading Staff , 4/8/2021
Comment0 comments  |  Read  |  Post a Comment
Handcuffs Over AI: Solving Security Challenges With Law Enforcement
Charles Herring, CTO and Co-Founder, WitFooCommentary
We've tried everything else ... now it's time to make the prospect of getting caught -- and punished -- a real deterrent to cybercrime.
By Charles Herring CTO and Co-Founder, WitFoo, 4/8/2021
Comment4 comments  |  Read  |  Post a Comment
Voice-Changing Software Found on APT Attackers' Server
Kelly Sheridan, Staff Editor, Dark ReadingQuick Hits
Security researchers believe the presence of Morph Vox Pro could indicate APT-C-23 has new plans for their phishing campaigns.
By Kelly Sheridan Staff Editor, Dark Reading, 4/7/2021
Comment0 comments  |  Read  |  Post a Comment
Cring Ransomware Used in Attacks on European Industrial Firms
Dark Reading Staff, Quick Hits
Attackers exploited a vulnerability in Fortigate VPN servers to gain access to target networks, researchers report.
By Dark Reading Staff , 4/7/2021
Comment0 comments  |  Read  |  Post a Comment
Fortune 500 Security Shows Progress and Pitfalls
Kelly Sheridan, Staff Editor, Dark ReadingNews
Fortune 500 companies have improved on email security and vulnerability disclosure programs but struggle in asset management and high-risk services.
By Kelly Sheridan Staff Editor, Dark Reading, 4/7/2021
Comment0 comments  |  Read  |  Post a Comment
Rethinking Cyberattack Response: Prevention & Preparedness
Hitesh Sheth, CEO, VectraCommentary
The SolarWinds incident is the starkest reminder yet that complacency can exact a terrible price.
By Hitesh Sheth CEO, Vectra, 4/7/2021
Comment1 Comment  |  Read  |  Post a Comment
5 Ways to Transform Your Phishing Defenses Right Now
Kevin O'Brien, Co-Founder and CEO, GreatHornCommentary
By transforming how you approach phishing, you can break the phishing kill chain and meaningfully reduce your business risk.
By Kevin O'Brien Co-Founder and CEO, GreatHorn, 4/7/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31414
PUBLISHED: 2021-04-16
The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.
CVE-2021-26073
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or ...
CVE-2021-26074
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a se...
CVE-2018-19942
PUBLISHED: 2021-04-16
A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QT...
CVE-2021-27691
PUBLISHED: 2021-04-16
Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request...