Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

News & Commentary
Carnival Cruise Line Reports Security Breach
Dark Reading Staff, Quick Hits
The cruise ship operator says the incident affected employee and guest data.
By Dark Reading Staff , 6/17/2021
Comment0 comments  |  Read  |  Post a Comment
Google Launches SLSA, a New Framework for Supply Chain Integrity
Dark Reading Staff, Quick Hits
The "Supply chain Levels for Software Artifacts" aims to ensure the integrity of components throughout the software supply chain.
By Dark Reading Staff , 6/17/2021
Comment0 comments  |  Read  |  Post a Comment
Biden Tells Putin Critical Infrastructure Sectors 'Off Limits' to Russian Hacking
Dark Reading Staff, Quick Hits
President Joe Biden said he and Russian President Vladimir Putin agreed to discuss boundaries in cyber activity.
By Dark Reading Staff , 6/16/2021
Comment0 comments  |  Read  |  Post a Comment
Keeping Your Organization Secure When Dealing With the Unexpected
Zane Lackey, Co-Founder and CSO of Signal SciencesCommentary
There's no way to anticipate every possible scenario, but the right approach to business continuity can help you respond effectively in any situation.
By Zane Lackey Co-Founder and CSO of Signal Sciences, 6/16/2021
Comment0 comments  |  Read  |  Post a Comment
Don't Get Stymied by Security Indecision
Alex Pezold, Founder & Chief Executive Officer, TokenExCommentary
You might be increasing cyber-risk by not actively working to reduce it.
By Alex Pezold Founder & Chief Executive Officer, TokenEx, 6/16/2021
Comment0 comments  |  Read  |  Post a Comment
Deloitte Buys Terbium Labs to Expand Threat Intel Capabilities
Dark Reading Staff, Quick Hits
Terbium Labs' products and services will become part of Deloitte's Detect & Respond lineup, the company confirms.
By Dark Reading Staff , 6/15/2021
Comment0 comments  |  Read  |  Post a Comment
What Industrial Control System Vulnerabilities Can Teach Us About Protecting the Supply Chain
Chen Fradkin, Security Researcher at ClarotyCommentary
Older technologies used in industrial and critical infrastructure leave the sector highly vulnerable to attack, but organizations can take steps to better protect themselves.
By Chen Fradkin Security Researcher at Claroty, 6/15/2021
Comment0 comments  |  Read  |  Post a Comment
Cyber Analytics Database Exposed 5 Billion Records Online
Dark Reading Staff, Quick Hits
In an ironic twist, Cognyte's data alerts customers to third-party data exposures.
By Dark Reading Staff , 6/14/2021
Comment0 comments  |  Read  |  Post a Comment
Google Workspace Adds Client-Side Encryption
Dark Reading Staff, Quick Hits
Users given control over encryption keys, Google says.
By Dark Reading Staff , 6/14/2021
Comment0 comments  |  Read  |  Post a Comment
Name That Toon: Sight Unseen
John Klossner, CartoonistCommentary
Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
By John Klossner Cartoonist, 6/14/2021
Comment10 comments  |  Read  |  Post a Comment
Details Emerge on How Gaming Giant EA Was Hacked
Dark Reading Staff, Quick Hits
Hacking group stole source code to FIFA 21 and the company's Frostbite engine.
By Dark Reading Staff , 6/11/2021
Comment0 comments  |  Read  |  Post a Comment
JBS CEO Says Company Paid $11M in Ransom
Dark Reading Staff, Quick Hits
The decision to pay attackers was a difficult one, CEO Andre Nogueira said in a statement.
By Dark Reading Staff , 6/10/2021
Comment0 comments  |  Read  |  Post a Comment
The Workforce Shortage in Cybersecurity Is a Myth
Michael Roytman, Chief Data Scientist, Kenna SecurityCommentary
What we really have is an automation-in-the-wrong-place problem.
By Michael Roytman Chief Data Scientist, Kenna Security, 6/10/2021
Comment0 comments  |  Read  |  Post a Comment
Required MFA Is Not Sufficient for Strong Security: Report
Robert Lemos, Contributing WriterNews
Attackers and red teams find multiple ways to bypass poorly deployed MFA in enterprise environments, underscoring how redundancy and good design are still required.
By Robert Lemos Contributing Writer, 6/9/2021
Comment0 comments  |  Read  |  Post a Comment
RSA Spins Off Fraud & Risk Intelligence Unit
Kelly Sheridan, Staff Editor, Dark ReadingNews
The new company, called Outseer, will continue to focus on payment authentication and fraud detection and analysis.
By Kelly Sheridan Staff Editor, Dark Reading, 6/9/2021
Comment0 comments  |  Read  |  Post a Comment
With Cloud, CDO and CISO Concerns Are Equally Important
Ameesh Divatia, Co-Founder & CEO of BaffleCommentary
Navigated properly, a melding of these complementary perspectives can help keep an organization more secure.
By Ameesh Divatia Co-Founder & CEO of Baffle, 6/9/2021
Comment0 comments  |  Read  |  Post a Comment
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game DesignerCommentary
Arbitrarily powerful software -- applications, operating systems -- is a problem, as is preventing it from running on enterprise systems.
By Adam Shostack Consultant, Entrepreneur, Technologist, Game Designer, 6/9/2021
Comment1 Comment  |  Read  |  Post a Comment
FBI Issued Encrypted Devices to Capture Criminals
Dark Reading Staff, Quick Hits
A sting operation delivered devices into the hands of global criminals and used the intelligence gathered to stop drug crimes.
By Dark Reading Staff , 6/8/2021
Comment0 comments  |  Read  |  Post a Comment
An Answer to APP Scams You Can Bank On
Amelia Ahlgren, EVP, Strategy and Operations, BioCatchCommentary
Financial institutions' usual fraud-detection methods can't detect most authorized push payment (APP) scams, putting customers and banks at risk.
By Amelia Ahlgren EVP, Strategy and Operations, BioCatch, 6/8/2021
Comment0 comments  |  Read  |  Post a Comment
Latvian Woman Charged for Role In Crafting Trickbot Malware
Dark Reading Staff, Quick Hits
Alla Witte and her associates are accused of using Trickbot to infect tens of millions of computers around the world, the Justice Department reports.
By Dark Reading Staff , 6/7/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-33347
PUBLISHED: 2021-06-18
An issue was discovered in JPress v3.3.0 and below. There are XSS vulnerabilities in the template module and tag management module. If you log in to the background by means of weak password, the storage XSS vulnerability can occur.
CVE-2021-33576
PUBLISHED: 2021-06-18
An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.
CVE-2021-33577
PUBLISHED: 2021-06-18
An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain.
CVE-2021-32536
PUBLISHED: 2021-06-18
The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform reflected XSS attacks.
CVE-2021-21669
PUBLISHED: 2021-06-18
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.