Dark Reading Daily -- December 03, 2022

API Secrets: Where the Bearer Model Breaks Down

Current authentication methods are based on the bearer model, but lack of visibility into the entities leveraging API secrets has made this untenable.

How the Cloud Changed Digital Forensics Investigations

The enterprise's shift to the cloud means digital forensics investigators have had to adopt new remote techniques and develop custom tools to uncover and process evidence off compromised devices.

AWS Unveils Amazon Security Lake at re:Invent 2022

Amazon Security Lake will allow organizations to create a purpose-built, standards-based data lake to aggregate and store security data.

How Development Teams Should Respond to Text4Shell

Yet another *4Shell exploit highlights the horror of strange visitors into enterprise environments. This Tech Tip focuses on what to do next.

Cyber Due Diligence in M&As Uncovers Threats, Improves Valuations

To get the full picture, companies need to look into the cybersecurity history and practices of the business they're acquiring.

CI Fuzz CLI Brings Fuzz Testing to Java Applications

CI Fuzz CLI, the open source fuzzing tool with just three commands, integrates fuzz testing directly into the software development workflow.

How to Use Cyber Deception to Counter an Evolving and Advanced Threat Landscape

Organizations must be prepared to root out bad actors by any means possible, even if it means setting traps and stringing lures.

Why Africa's Telecoms Must Actively Collaborate to Combat Fraud

Unique conditions contribute to outsized telecom fraud across the continent, but working together can bring solutions.

Amid Legal Fallout, Cyber Insurers Redefine State-Sponsored Attacks as Act of War

As carriers rewrite their act-of-war exclusions following the NotPetya settlement between Mondelez and Zurich, organizations should read their cyber insurance policies carefully to see what is still covered.

Google Releases YARA Rules to Disrupt Cobalt Strike Abuse

The popular pen-testing tool is often cracked and repurposed by threat actors. Google now has a plan to address that.

Microsoft Defender Gets New Security Protections

The new Microsoft Defender for Endpoint capabilities include built-in protection and scanning network traffic for malicious activity.

Major Security Breach From Business Users' Low-Code Apps Could Come in 2023, Analysts Warn

Here's what that means about our current state as an industry, and why we should be happy about it.

Cybersecurity Pros Put Mastodon Flaws Under the Microscope

As the open source social media network grabs the spotlight as a Twitter replacement, researchers caution about vulnerabilities.

FROM THE NEWS DESK

IBM Cloud Supply Chain Vulnerability Showcases New Threat Class

The Hell's Keychain attack vector highlights common cloud misconfigurations and secrets exposure that can pose grave risk to enterprise customers.

Developing and Testing an Effective Breach Response Plan