Dark Reading Daily -- June 15, 2022

Microsoft Patches 'Follina' Zero-Day Flaw in Monthly Security Update

Here are which Microsoft patches to prioritize among the June Patch Tuesday batch.

Beware the 'Secret Agent' Cloud Middleware

New open source database details the software that cloud service providers typically silently install on enterprises' virtual machines — often unbeknownst to customers.

Chinese Threat Actor Employs Fake Removable Devices as Lures in Cyber-Espionage Campaign

"Aoqin Dragon" has been operating since at least 2013, with targets including government and telecommunications companies in multiple countries.

Google: SBOMs Effective Only if They Map to Known Vulns

SBOMs should be connected with vulnerability databases to fulfill their promise of reducing risk, Google security team says.

In Case You Missed RSA Conference 2022: A News Digest

Here's a rundown of Dark Reading's reporting and commentary from and surrounding the first in-person RSA Conference since the pandemic began in 2020.

Understanding and Mitigating Single Sign-on Risk

SSO's one-to-many architecture is both a big advantage and a weakness.

How Can Security Partnerships Help to Mitigate the Increasing Cyber Threat?

Martyn Ryder from Morphean explains why forging trusted partnerships is integral to the future of physical security in a world of networks, systems, and the cloud.

DDoS Subscription Service Operator Gets 2 Years in Prison

The distributed denial-as-a-service websites were behind more than 200K attacks on targets including schools and hospitals.

Design Weakness Discovered in Apple M1 Kernel Protections

The proof-of-concept attack from MIT CSAIL researchers undermines the pointer authentication feature used to defend the Apple chip's OS kernel.

Artificial Intelligence and Security: What You Should Know

Next-generation AI products learn proactively and identify changes in the networks, users, and databases using "data drift" to adapt to specific threats as they evolve.

CISA Recommends Organizations Update to the Latest Version of Google Chrome

Google last week reported seven vulnerabilities in the browser, four of which it rated as high severity.

LATEST FROM THE EDGE

Veterans Explain How Military Service Prepared Them for Cybersecurity Careers

The ability to handle intense pressure is just one of the skills that veterans bring to corporate cybersecurity work.

LATEST FROM DR TECHNOLOGY

Quantifying the SaaS Supply Chain and Its Risks

Organizations do not have good visibility into all the software-as-a-service applications that connect to and access data stored in core business.

Improving Enterprise Cybersecurity With XDR