Dark Reading Weekly -- December 29, 2022

New Year's Surprise: Cybersecurity M&A, Funding Activity Snowballs in Q4

Concerns about recessionary trends impacting the cybersecurity sector in 2022 remained largely unfounded in Q4, as investment activity surged after a Q3 slowdown.

Container Verification Bug Allows Malicious Images to Cloud Up Kubernetes

A complete bypass of the Kyverno security mechanism for container image imports allows cyberattackers to completely take over a Kubernetes pod to steal data and inject malware.

Internet AppSec Remains Abysmal & Requires Sustained Action in 2023

A variety of initiatives — such as memory-safe languages and software bills of materials — promise more secure applications, but sustained improvements will require that vendors do much better, researchers agree.

Inside the Next-Level Fraud Ring Scamming Billions Off Holiday Retailers

"Largest attack of its kind": A potent Southeast Asian e-commerce fraud ring has declared war on US retailers, targeting billions in goods in just the past month and forcing mules into its scheme.

Google: With Cloud Comes APIs & Security Headaches

APIs are key to cloud transformation, but two Google surveys find that cyberattacks targeting them are reaching a tipping point, even as general cloud security issues abound.

Security on a Shoestring? Cloud, Consolidation Best Bets for Businesses

With a recession potentially coming, some companies are cutting security teams. But moving more infrastructure to the cloud and reducing the number of vendors through consolidation may be the best ways to prepare.

After the Uber Breach: 3 Questions All CISOs Should Ask Themselves

How CISOs handle the ethical issues around data breaches can make or break their careers. Don't wait until a breach happens to plot the course forward.

The Threat of Predictive Policing to Data Privacy and Personal Liberty

Inaccurate information from data brokers can damage careers and reputations. It's time for US privacy laws to change how law enforcement and legal agencies obtain and act on data.

Fool Me Thrice? How to Avoid Double and Triple Ransomware Extortion

To stay safer, restrict access to data, monitor for breaches in the supply chain, track relevant data that is sold on the Dark Web, and implement best safety practices.

Why Cyber Pros and Forensic Accountants Should Work Together to Mitigate Security Risk

It's time companies build a multilayered approach to cybersecurity.

Threat Modeling in the Age of OpenAI's Chatbot

New technical chatbot capabilities raise the promise that their help in threat modeling could free humans for more interesting work.

The Promise and Reality of Cloud Security