Dark Reading Daily -- October 24, 2022

Google's GUAC Aims to Democratize Software Supply Chain Security Metadata

Software makers and customers will be able to query graph database for information about the security and provenance of components in applications and codebases.

List of Common Passwords Accounts for Nearly All Cyberattacks

Half of a million passwords from the RockYou2021 list account for 99.997% of all credential attacks against a variety of honeypots, suggesting attackers are just taking the easy road.

Exploit Attempts Underway for Apache Commons Text4Shell Vulnerability

The good news: The Apache Commons Text library bug is far less likely to lead to exploitation than last year's Log4j library flaw.

FBI: Iranian Threat Group Likely to Target US Midterms

Similar to what happened around the 2020 election, FBI warns that the Emennet Pasargad group is poised to target officials and companies with embarrassing hack-and-leak campaigns.

Iron Man Started His Journey From Scratch & Your Security Awareness Program Can Too

Build your company's security awareness program a suit of high-tech cybersecurity armor along with a collaborative atmosphere.

Microsoft Data-Exposure Incident Highlights Risk of Cloud Storage Misconfiguration

Many enterprises continue to leave cloud storage buckets exposed despite widely available documentation on how to properly secure them.

Apache Commons Vulnerability: Patch but Don't Panic

Experts say CVE-2022-42899 is a serious vulnerability, but widespread exploitation is unlikely because of the specific conditions that need to exist for it to happen.

Are You a CISO Building Your Risk Register for 2023? Read This First

Achieving basic IT hygiene is 99% of the game.

8 Trends Driving Cybersecurity in the Public Sector

CISOs and security leaders in state and local governments are dealing with increasing threats like ransomware — with varying degrees of cyber maturity.

LATEST FROM THE EDGE

What Is the Difference Between Identity Verification and Authentication?

Identity verification and identity authentication are neither synonymous nor interchangeable, and implementing both is essential to fighting fraud.

LATEST FROM DR TECHNOLOGY

Passkey Demos Hint at What's Ahead for Passwordless Authentication

At the Authenticate Conference, Google and Microsoft demonstrated their passkey prototypes. Apple, meanwhile, already launched its version in iOS 16.

Building the SOC of the Future