Dark Reading Daily -- December 02, 2022

One Year After Log4Shell, Most Firms Are Still Exposed to Attack

Though there have been fewer than expected publicly reported attacks involving the vulnerability, nearly three-quarters of organizations remain exposed to it.

LastPass Discloses Second Breach in Three Months

The threat actor behind an August intrusion used data from that incident to access customer data stored with a third-party cloud service provider, and affiliate GoTo reports breach of development environment.

Artifact Poisoning in GitHub Actions Imports Malware via Software Pipelines

A vulnerability discovered in GitHub Actions could allow an attacker to poison a developer's pipeline, highlighting the risk that insecure software pipelines pose.

IBM Cloud Supply Chain Vulnerability Showcases New Threat Class

The Hell's Keychain attack vector highlights common cloud misconfigurations and secrets exposure that can pose grave risk to enterprise customers.

Data Security Concerns Are Driving Changes in US Consumer Behavior and Demands

As consumers catch on to the dangers, protection could become a major topic for legislative bodies.

Bring Your Own Key — A Placebo?

BYOK was envisioned to reduce the risk of using a cloud service provider processing sensitive data, yet there are several deficiencies.

CISA's Strategic Plan Is Ushering in a New Cybersecurity Era

Today's cyber environment requires less emphasis on detection and perimeter defenses and more focus on bolstering security with resilience.

Nvidia GPU Driver Bugs Threaten Device Takeover & More

If unpatched, a host of GPU Display Driver flaws could expose gamers, graphic designers, and others to code execution, denial of service, data tampering, and more.

New Exploit Broker on the Scene Pays Premium for Signal App Zero-Days

Signal messaging app zero-day vulnerabilities have sparked a $1.5M bidding match, as gray-market exploit brokers flourish in today's geopolitical climate.

LATEST FROM THE EDGE

How the Cloud Changed Digital Forensics Investigations

The enterprise's shift to the cloud means digital forensics investigators have had to adopt new remote techniques and develop custom tools to uncover and process evidence off compromised devices.

LATEST FROM DR TECHNOLOGY

AWS Unveils Amazon Security Lake at re:Invent 2022

Amazon Security Lake will allow organizations to create a purpose-built, standards-based data lake to aggregate and store security data.

Creating an Effective Incident Response Plan