Dark Reading Weekly -- December 17, 2020

18,000 Organizations Possibly Compromised in Massive Supply-Chain Cyberattack

Nation-state attackers used poisoned SolarWinds network management software updates to distribute malware; US government orders federal civilian agencies to immediately power down the technology.

FireEye Identifies Killswitch for SolarWinds Malware as Victims Scramble to Respond

White House National Security Council establishes unified group to coordinate response across federal agencies to the threat.

Medical Imaging Leaks Highlight Unhealthy Security Practices

More than 45 million unique images, such as X-rays and MRI scans, are accessible to anyone on the Internet, security firm says.

Attackers Leverage IMAP to Infiltrate Email Accounts

Researchers believe cybercriminals are using a tool dubbed Email Appender to directly connect with compromised email accounts via IMAP.

VPNs, MFA & the Realities of Remote Work

The work-from-home-era is accelerating cloud-native service adoption.

Penetration Testing: A Road Map for Improving Outcomes

As cybersecurity incidents gain sophistication, to ensure we are assessing security postures effectively, it is critical to copy real-world adversaries' tools, tactics, and procedures during testing activities.

Microsoft Warns of Powerful New Adware

The new adware, dubbed Adrozek, is being distributed by large, well organized threat actors, according to Microsoft research.

Patching Still Poses Problems for Industrial Controllers, Networking Devices

More than 90% of devices that run popular embedded operating systems remain vulnerable to critical flaws disclosed more than a year ago.

The Private Sector Needs a Cybersecurity Transformation

Cybersecurity must get to the point where it's equated with actually stopping an attack by identifying the methods the bad guys use and taking those methods away.

Why Secure Email Gateways Rewrite Links (and Why They Shouldn't)

Redirecting a user to a trusted server buys a secure email gateway company some time while it decides whether a URL is malicious -- but there are avoidable drawbacks to this approach.

EDITORS' CHOICE

7 Security Tips for Gamers

Gamers can expect to be prime targets over the holidays as COVID-19 rages on. Here's some advice on how to keep hackers at bay.

Flash Poll: Ransomware Response

How confident are you in your organization's plan for responding to a ransomware attack?

LATEST FROM THE EDGE

2021 Security Budgets: Top Priorities, New Realities

An unprecedented 2020 has shaken up security leaders' usual list of must-have technologies. What's on the horizon? They share with us their spending plans for 2021.

2020: The Year in Security