Dark Reading Daily -- January 18, 2023

Initial Access Broker Market Booms, Posing Growing Threat to Enterprises

A rapid increase in the number of operators in the space — the "locksmiths" of the cyber underground — has made it substantially cheaper for cybercriminals to buy access to target networks.

Microsoft Patches 4 SSRF Flaws in Separate Azure Cloud Services

Two of the vulnerabilities — in Azure Functions and Azure Digital Twins — required no account authentication for an attacker to exploit them.

Unpatched Zoho MangeEngine Products Under Active Cyberattack

The latest critical bug is exploitable in dozens of ManageEngine products and exposes systems to catastrophic risks, researchers warn.

5 Cybersecurity Tips for Higher Education Institutions

Following these basic cybersecurity hygiene policies can help make data more secure and protect colleges and universities from becoming the next ransomware headline. The steps aren't complicated, and they won't break the bank.

Why Businesses Need to Think Like Hackers This Year

Security professionals must update their skill sets and be proactive to stay ahead of cybercriminals. It's time to learn to think and act like an attacker to cope with the cyber "new normal."

Attackers Are Already Exploiting ChatGPT to Write Malicious Code

The AI-based chatbot is allowing bad actors with absolutely no coding experience to develop malware.

The Dangers of Default Cloud Configurations

Default settings can leave blind spots but avoiding this issue can be done.

Java, .NET Developers Prone to More Frequent Vulnerabilities

About three-quarters of Java and .NET applications have vulnerabilities from the OWASP Top 10 list, while only 55% of JavaScript codebases have such flaws, according to testing data.

CircleCI, LastPass, Okta, and Slack: Cyberattackers Pivot to Target Core Enterprise Tools

High-profile software provider compromises in the past few months show that threat actors are actively targeting the services underpinning corporate infrastructure. Here's what to do about it.

LATEST FROM THE EDGE

3 Lessons Learned in Vulnerability Management

In 2022, multiple high-profile vulnerabilities like Log4j and OpenSSL provided important takeaways for future public reporting.

LATEST FROM DR TECHNOLOGY

Okta Expands No-Code Offerings for Identity Cloud

With Actions Integrations, Okta is expanding its no-code offerings to help administrators manage and customize their identity workflow.

The Promise and Reality of Cloud Security