Dark Reading Daily -- January 24, 2020

Ryuk Ransomware Hit Multiple Oil & Gas Facilities, ICS Security Expert Says

Attackers 'weaponized' Active Directory to spread the ransomware.

The Annoying MacOS Threat That Won't Go Away

In two years, the adware-dropping Shlayer Trojan has spread to infect one in 10 MacOS systems, Kaspersky says.

Severe Vulnerabilities Discovered in GE Medical Devices

CISA has released an advisory for six high-severity CVEs for GE Carescape patient monitors, Apex Pro, and Clinical Information Center systems.

Deconstructing Web Cache Deception Attacks: They're Bad; Now What?

Expect cache attacks to get worse before they get better. The problem is that we don't yet have a good solution.

Weathering the Privacy Storm from GDPR to CCPA & PDPA

A general approach to privacy, no matter the regulation, is the only way companies can avoid a data protection disaster in 2020 and beyond.

NSA Offers Guidance on Mitigating Cloud Flaws

A new document separates cloud vulnerabilities into four classes and offers mitigations to help businesses protect cloud resources.

DHS Warns of Increasing Emotet Risk

Emotet is considered one of the most damaging banking Trojans, primarily through its ability to carry other malware into an organization.

7 Ways to Get the Most Out of a Penetration Test

You'll get the best results when you're clear on what you want to accomplish from a pen test.

Massive Oracle Patch Reverses Company's Trend Toward Fewer Flaws

Following a year that saw the fewest number of vulnerabilities reported since 2015, Oracle's latest quarterly patch fixes nearly 200 new vulnerabilities.

Elaborate Honeypot 'Factory' Network Hit with Ransomware, RAT, and Cryptojacking

A fictitious industrial company with phony employees personas, website, and PLCs sitting on a simulated factory network fooled malicious hackers - and raised alarms for at least one white-hat researcher who stumbled upon it.

EDITORS' CHOICE

7 Tips for Infosec Pros Considering A Lateral Career Move

Looking to switch things up but not sure how to do it? Security experts share their advice for switching career paths in the industry.

Cybersecurity Lessons Learned from 'The Rise of Skywalker'

They're especially relevant regarding several issues we face now, including biometrics, secure data management, and human error with passwords.

NEW FROM THE EDGE

The Y2K Boomerang: InfoSec Lessons Learned from a New Date-Fix Problem

We all make assumptions. They rarely turn out well. A new/old date problem offers a lesson in why that's so.

IT 2020: A Look Ahead