New Normal Demands New Security Leadership Structure

At the inaugural Omdia Analyst Summit, experts discuss where the past year has created gaps in traditional security strategy and how organizations can fill them.

Multiple Zero-Day Flaws Discovered in Popular Hospital Pneumatic Tube System

"PwnedPiper" flaws could allow attackers to disrupt delivery of lab samples or steal hospital employee credentials, new research shows.

8 Security Tools to be Unveiled at Black Hat USA

Security researchers and practitioners share a host of new cyber tools for penetration testing, reverse engineering, malware defense, and more.

Biden Administration Responds to Geopolitical Cyber Threats

In response to growing concerns regarding the recent uptick in large-scale, nation-state-backed ransomware attacks on critical infrastructure, the Biden administration is taking new action to tackle the evolving challenges posed by ransomware attacks.

7 Hot Cyber Threat Trends to Expect at Black Hat

A sneak peek of some of the main themes at Black Hat USA next month.

Law Firm for Ford, Pfizer, Exxon Discloses Ransomware Attack

Campbell Conroy & O'Neil reports the attack affected personal data including Social Security numbers, passport numbers, and payment card data for some individuals.

US Accuses China of Using Criminal Hackers in Cyber Espionage Operations

DOJ indicts four Chinese individuals for alleged role in attacks targeting intellectual property, trade secrets belonging to defense contractors, maritime companies, aircraft service firms, and others.

How Gaming Attack Data Aids Defenders Across Industries

Web application attacks against the video game industry quadrupled in 2020 compared to the previous year, but companies outside entertainment can learn from the data.

NSO Group Spyware Used On Journalists & Activists Worldwide

An investigation finds Pegasus spyware, intended for use on criminals and terrorists, has been used in targeted campaigns against others around the world.

When Ransomware Comes to (Your) Town

While steps for defending against a ransomware attack vary based on the size of the government entity and the resources available to each one, rooting out ransomware ultimately will come down to two things: system architecture and partnerships.

7 Ways AI and ML Are Helping and Hurting Cybersecurity

In the right hands, artificial intelligence and machine learning can enrich our cyber defenses. In the wrong hands, they can create significant harm.

Breaking Down the Threat of Going All-In With Microsoft Security

Limit risk by dividing responsibility for infrastructure, tools, and security.

Researchers Create New Approach to Detect Brand Impersonation

A team of Microsoft researchers developed and trained a Siamese Neural Network to detect brand impersonation attacks.

Recent Attacks Lead to Renewed Calls for Banning Ransom Payments

While attackers in protected jurisdictions continue to get massive sums for continuing to breach organizations, the ransomware threat will only continue to grow.

4 Future Integrated Circuit Threats to Watch

Threats to the supply chains for ICs and other computer components are poised to wreak even more havoc on organizations.

How to Attract More Computer Science Grads to the Cybersecurity Field

With 465,000 cybersecurity job openings in the United States, why is recruiting so difficult? A recent college graduate offers his take.

Attackers Exploited 4 Zero-Day Flaws in Chrome, Safari & IE

At least two government-backed actors -- including one Russian group -- used the now-patched flaws in separate campaigns, Google says.

State Dept. to Pay Up to $10M for Information on Foreign Cyberattacks

The Rewards for Justice program, a counterterrorism tool, is now aimed at collecting information on nation-states that use hackers to disrupt critical infrastructure.

CISA Launches New Website to Aid Ransomware Defenders

StopRansomware.gov provides information to help organizations protect against, and respond to, ransomware attacks.

Microsoft: Israeli Firm's Tools Used to Target Activists, Dissidents

Candiru sold spyware that exploited Windows vulnerabilities and had been used in attacks against dissidents, activists, and journalists.

IoT-Specific Malware Infections Jumped 700% Amid Pandemic

Gafgyt and Mirai malware represented majority of IoT malware, new data from Zscaler shows.

How to Bridge On-Premises and Cloud Identity

Identity fabric, a cloud-native framework, removes the need for multiple, siloed, proprietary identity systems.

What to Look for in an Effective Threat Hunter

The most important personality traits, skills, and certifications to look for when hiring a threat hunting team.

SonicWall: 'Imminent' Ransomware Attack Targets Older Products

The attack exploits a known vulnerability that was fixed in new versions of firmware released this year.

Google to Bring HTTPS-First Mode to Chrome Browser

Beginning in M94, Chrome will offer HTTPS-First Mode, which will attempt to upgrade all page loads to HTTPS.

Targeted Attack Activity Heightens Need for Orgs. to Patch New SolarWinds Flaw

A China-based threat actor -- previously observed targeting US defense industrial base organizations and software companies -- is exploiting the bug in SolarWinds' Serv-U software, Microsoft says.

Did the Cybersecurity Workforce Gap Distract Us From the Leak?

Cyber games can play a critical role in re-engaging our workforce and addressing the employee retention crisis.

10 Mistakes Companies Make In Their Ransomware Responses

Hit by ransomware? These missteps can take a bad scenario and make it even worse.

4 Integrated Circuit Security Threats and How to Protect Against Them

Little-understood threats involving the IC supply chain are putting organizations around the world at risk.

New Phishing Campaign Targets Individuals of Interest to Iran

TA453 group spoofed two scholars at University of London to try and gain access to email inboxes belonging to journalists, think tank personnel, academics, and others, security vendor says.

Microsoft Patches 3 Windows Zero-Days Amid 117 CVEs

The July Patch Tuesday release also includes the out-of-band fix for the Windows Print Spooler remote code execution flaw under attack.

DoD-Validated Data Security Startup Emerges From Stealth

The Code-X platform has been tested by the US Department of Defense and members of the intelligence community.

Why We Need to Raise the Red Flag Against FragAttacks

Proliferation of wireless devices increases the risk that corporate networks will be attacked with this newly discovered breed of Wi-Fi-based cyber assault.

Enterprises Altering Their Supply Chain Defenses on Heels of Latest Breaches

More than half of enterprises surveyed for Dark Reading's State of Malware Threats report indicate they are making at least a few changes to their supply chain security defenses following recent attacks on software vendors such as SolarWinds.

Can Government Effectively Help Businesses Fight Cybercrime?

From the Biden administration's pledge to take action to INTERPOL's focus on ransomware as a global threat, governments are looking to help businesses cope with cyberattacks. But can it really work?

The Trouble With Automated Cybersecurity Defenses

While there's enormous promise in AI-powered tools and machine learning, they are very much a double-edged sword.

Tool Sprawl & False Positives Hold Security Teams Back

Security teams spend as much time addressing false positive alerts as they do addressing actual cyberattacks, survey data shows.

SolarWinds Discloses Zero-Day Under Active Attack

The company confirms this is a new vulnerability that is not related to the supply chain attack discovered in December 2020.

Microsoft Confirms Acquisition of RiskIQ

RiskIQ's technology helps businesses assess their security across the Microsoft cloud, Amazon Web Services, other clouds, and on-premises.

Kaseya Releases Security Patch as Companies Continue to Recover

Estimates indicate the number of affected companies could grow, while Kaseya faces renewed scrutiny as former employees reportedly criticize its lack of focus on security.

AI and Cybersecurity: Making Sense of the Confusion

Artificial intelligence is a maturing area in cybersecurity, but there are different concerns depending on whether you're a defender or an attacker.

Navigating Active Directory Security: Dangers and Defenses

Microsoft Active Directory, ubiquitous across enterprises, has long been a primary target for attackers seeking network access and sensitive data.

How Dangerous Is Malware? New Report Finds It's Tough to Tell

Determining which malware is most damaging, and worthy of immediate attention, has become difficult in environments filled with alerts and noise.

CISA Analysis Reveals Successful Attack Techniques of FY 2020

The analysis shows potential attack paths and the most effective techniques for each tactic documented in CISA's Risk and Vulnerability Assessments.

New Framework Aims to Describe & Address Complex Social Engineering Attacks

As attackers use more synthetic media in social engineering campaigns, a new framework is built to describe threats and provide countermeasures.

I Smell a RAT! New Cybersecurity Threats for the Crypto Industry

The ElectroRAT Trojan attacker's success highlights the increasingly sophisticated nature of threats to cryptocurrency exchanges, wallets, brokerages, investing, and other services.

It's in the Game (but It Shouldn't Be)

Five ways that game developers (and others) can avoid falling victim to an attack like the one that hit EA.

Cartoon Caption Winner: Sight Unseen

And the winner of Dark Reading's June contest is ...

Morgan Stanley Discloses Data Breach

Attackers were able to compromise customers' personal data by targeting the Accellion FTA server of a third-party vendor.

New WildPressure Malware Capable of Targeting Windows and MacOS

The Trojan sends information back to the attackers' servers about the programming language of a target device.

Kaseya Hacked via Authentication Bypass

The Kaseya ransomware attack is believed to have been down to an authentication bypass. Yes, ransomware needs to be on your radar -- but good authentication practices are also imperative.

The NSA's 'New' Mission: Get More Public With the Private Sector

The National Security Agency's gradual emergence from the shadows was "inevitable" in cybersecurity, says Vinnie Liu, co-founder and CEO of offensive security firm Bishop Fox and a former NSA analyst. Now the agency has to figure out how to best work with the private sector, especially organizations outside the well-resourced and seasoned Fortune 100.

What Colonial Pipeline Means for Commercial Building Cybersecurity

Banks and hospitals may be common targets, but now commercial real estate must learn to protect itself against stealthy hackers.

Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours

Automation allowed a REvil affiliate to move from exploitation of vulnerable servers to installing ransomware on downstream companies faster than most defenders could react.

Fake Android Apps Promise Cryptomining Services to Steal Funds

Researchers discover more than 170 Android apps that advertise cloud cryptocurrency mining services and fail to deliver.

Sophos Acquires Capsule8 for Linux Server & Container Security

The deal was announced the same day ZeroFox bought Dark Web intelligence firm Vigilante as a wave of security M&A continues.

Are Security Attestations a Necessity for SaaS Businesses?

Are security attestations becoming business imperatives, or are they merely token additions on the list of regulatory requirements?

Microsoft Releases Emergency Patch for 'PrintNightmare' Vuln

It urges organizations to immediately apply security update, citing exploit activity.

Security 101: The 'PrintNightmare' Flaw

A closer look at the printer software vulnerability - and what you can do about it.

Autonomous Security Is Essential if the Edge Is to Scale Properly

Service demands at the network edge mean customers need to get cost, performance, and security right.