Dark Reading Daily -- October 20, 2022

Apache Commons Vulnerability: Patch but Don't Panic

Experts say CVE-2022-42899 is a serious vulnerability, but widespread exploitation is unlikely because of the specific conditions that need to exist for it to happen.

China-Linked Cyber-Espionage Team Homes In on Hong Kong Government Orgs

The Winnti APT was spotted dropping several variants of Spyder Loader and other malware as part of the so-called Operation Cuckoobees.

Microsoft Customer Data Exposed by Misconfigured Server

The data exposure was the result of an "unintentional misconfiguration on an endpoint" and not a security vulnerability, Microsoft said.

A New Solution to the Cybersecurity Skills Gap: Building Security into Operational Teams

Why — and how — companies should consider shifting day-to-day security responsibilities out to operations teams. The move would elevate the team's level of decision-making and help address the challenge of finding professionals with security-specific credentials.

SBOMs: An Overhyped Concept That Won't Secure Your Software Supply Chain

We need more than the incomplete snapshot SBOMs provide to have real impact.

Emotional Toll From Cyberattacks Can Linger Among Staff for Years

Research shows 1 in 7 employees involved in a cyberattack exhibits clinical trauma symptoms months after the incident.

Scammers Targeting Those Seeking Student Loan Forgiveness

FBI warns that cybercriminals are stealing personal information by posing as administrators of the Student Loan Debt Relief Plan.

CISA Offers Free RedEye Analytics Tool for Red Teams

The tool helps red teams manage their activities, analyze the data from their campaigns, create reports, and better present results to organizations.

Shared Responsibility or Shared Fate? Decentralized IT Means We Are All Cyber Defenders

With the IT universe expanding, collaboration, thoughtfulness, and discipline can ensure a more secure future.

4 Stakeholders Critical to Addressing the Cybersecurity Workforce Gap

A cross-disciplinary effort of change is needed to attract new professionals in the coming decade.

Phishing Mitigation Can Cost Businesses More Than $1M Annually

One of the oldest tactics in cybercrime is still one of the most widely feared — and with good reason, as campaigns are expected to increase and become more sophisticated over the next 12 months.

LATEST FROM THE EDGE

What Fast-Talkers Can Teach Us About Vetting Vendors

Here's how to differentiate vendors that can back up their words with solutions and those that cannot.

LATEST FROM DR TECHNOLOGY

Security Awareness Urged to Grow Beyond Compliance

Increasingly vendors are looking for ways to take security awareness beyond checkbox compliance courses to more context-dependent interactions — a "shift left" to the average worker.

Building the SOC of the Future