Dark Reading Daily -- September 26, 2019

When Compliance Isn't Enough: A Case for Integrated Risk Management

Why governance, risk, and compliance solutions lull companies into a false sense of security, and how to form a more effective approach.

Web Attacks Focus on SQL Injection, Malware on Credentials

Attackers continue to focus on bread-and-butter tactics, according to a quarterly threat report.

GandCrab Developers Behind Destructive REvil Ransomware

Code similarities show a definite technical link between the malware strains, Secureworks says.

Long-Lining: Reeling In the Big Fish in Your Supply Chain

The object of this new attack campaign is not swordfish or tuna but high-ranking executives within target organizations.

The Future of Account Security: A World Without Passwords?

First step: Convince machines that we are who we say we are with expanded biometrics, including behaviors, locations, and other information that makes "us" us.

New Emergency Communications Plan Released by CISA

The Cybersecurity and Infrastructure Security Agency's latest version of the National Emergency Communications Plan comes after a two-year process to improve the cybersecurity and flexibility of the nation's emergency communications.

Microsoft's Azure Sentinel SIEM Now Generally Available

The cloud-native SIEM is designed to search data from users, applications, servers, and devices running on-prem and in the cloud.

7 Ways VPNs Can Turn from Ally to Threat

VPNs are critical pieces of the security infrastructure, but they can be vulnerable, hackable, and weaponized against you. Here are seven things to be aware of before you ignore your VPN.

Metasploit Creator HD Moore's Latest Hack: IT Assets

Moore has built a network asset discovery tool that wasn't intended to be a pure security tool, but it addresses a glaring security problem.

The 20 Worst Metrics in Cybersecurity

Security leaders are increasingly making their case through metrics, as well they should - as long as they're not one of these.

EDITORS' CHOICE

5 Updates from PCI SSC That You Need to Know

As payment technologies evolve, so do the requirements for securing cardholder data.

NEW FROM THE EDGE

The Beginner's Guide to Denial-of-Service Attacks: A Breakdown of Shutdowns

DoS attacks come in many varieties (not just DDoS). This simple set of descriptions will help you understand how they're different - and why each and every one is bad.

Cloud Insight ... and Stuff

All fluff, all the time.

7 Threats & Disruptive Forces Changing the Face of Cybersecurity