Dark Reading Daily -- November 10, 2022

Patch ASAP: Critical Citrix, VMware Bugs Threaten Remote Workspaces With Takeover

Hole-y software alert, Batman: Cybercriminal faves Citrix Gateway and VMware Workspace ONE have authentication-bypass bugs that could offer up total access to attackers.

Cloud9 Malware Offers a Paradise of Cyberattack Methods

The Swiss Army knife-like browser extension is heaven for attackers — and can be hell for enterprise users.

Malicious Python Package Relies on Steganography to Download Malware

The malicious package downloads an image from the Web, then uses a steganography module to extract and execute the code to download malware.

InterPlanetary File System Increasingly Weaponized for Phishing, Malware Delivery

Cyberattackers like IPFS because it is resilient to content blocking and takedown efforts.

Long Island Midterm Votes Delayed Due to Cyberattack Aftereffects

Suffolk County had to hand deliver voting databases with ballot results to the county election headquarters.

What We Really Mean When We Talk About ‘Cybersecurity’

A lack of precision in our terminology leads to misunderstandings and confusion about the activities we engage in, the information we share, and the expectations we hold.

A Better Way to Resist Identity-Based Cyber Threats

New approaches to identity access management are indispensable.

Experian, T-Mobile Pay Up in Multimillion-Dollar Data Breach Settlements

Massachusetts Attorney General announced settlements across multiple states for damages from Experian's 2012 and 2015 breaches that violated consumer protection and notification laws.

Microsoft's Certificate-Based Authentication Enables Phishing-Resistant MFA

Microsoft added certificate-based authentication (CBA) to the Azure Active Directory to help organizations enable phishing-resistant MFA that complies with US federal requirements. The change paves the way for enterprises to migrate their Active Directory implementations to the cloud.

It's Time to See Cybersecurity Regulation as a Friend, Not a Foe

There's real value in having a better perspective around future regulation and compliance requirements.

The Shifting Role of the CISO

My year as a venture capital CISO-in-residence.

Microsoft Quashes Bevy of Actively Exploited Zero-Days for November Patch Tuesday

Long-awaited security fixes for ProxyNotShell and Mark of the Web bypasses are part of a glut of actively exploited zero-day vulnerabilities and other critical flaws that admins need to prioritize in the coming hours.

LATEST FROM THE EDGE

How US Businesses Suffer From the Lack of Personal Data Privacy Laws

The stalling of federal legislation and the continued expansion of data brokers are fueling a phishing epidemic.

LATEST FROM DR TECHNOLOGY

Detecting Malicious User Behavior Within and Across Applications

The solution lies in analyzing sequences of activities as user journeys, instead of analyzing each activity on its own.

How Enterprises Are Attacking the Cybersecurity Problem