Application Security
News & Commentary
Data Management Vs. Data Loss Prevention: Vive La Différence!
Todd Feinman,  President & CEO, Identity FinderCommentary
A sensitive data management strategy can include the use of DLP technology, but it also involves a comprehensive understanding of where your data is and what specifically is at risk.
By Todd Feinman President & CEO, Identity Finder, 11/25/2014
Comment1 Comment  |  Read  |  Post a Comment
Don't Discount XSS Vulnerabilities
Ericka Chickowski, Contributing Writer, Dark ReadingNews
XSS flaws are more serious than you'd think.
By Ericka Chickowski Contributing Writer, Dark Reading, 11/24/2014
Comment0 comments  |  Read  |  Post a Comment
Cyber Security Needs Its Ralph Nader
Tsion Gonen , Chief Strategy Officer, SafeNetCommentary
It took thousands of unnecessary traffic fatalities to create an environment for radical transformation of the auto industry. What will it take for a similar change to occur in data security?
By Tsion Gonen Chief Strategy Officer, SafeNet, 11/24/2014
Comment11 comments  |  Read  |  Post a Comment
Microsoft Fixes Critical SChannel & OLE Bugs, But No Patches For XP
Sara Peters, Senior Editor at Dark ReadingNews
No patches released for the now-unsupported XP even though the 19-year-old OLE bug is critical and "Winshock" bug in Windows' SSL/TLS installation could be worse than Heartbleed.
By Sara Peters Senior Editor at Dark Reading, 11/14/2014
Comment20 comments  |  Read  |  Post a Comment
Video: Google Inbox, BitCoin On Wall Street, & More
Andrew Conry Murray, Director of Content & Community, InteropCommentary
This Week In 60 Seconds looks at the new Google Inbox, how BitCoin could change financial services, and other top stories.
By Andrew Conry Murray Director of Content & Community, Interop, 11/14/2014
Comment0 comments  |  Read  |  Post a Comment
The Staggering Complexity of Application Security
Jeff Williams, CTO, Aspect Security & Contrast SecurityCommentary
During the past few decades of high-speed coding we have automated our businesses so fast that we are now incapable of securing what we have built.
By Jeff Williams CTO, Aspect Security & Contrast Security, 11/10/2014
Comment6 comments  |  Read  |  Post a Comment
Stop Trusting Signed Malware: 3 Steps
Paul Drapeau, Principal Security Researcher, ConferCommentary
Cybercriminals who manipulate valid signatures and certificates to get malware into an organization is a more common tactic than you think.
By Paul Drapeau Principal Security Researcher, Confer, 11/7/2014
Comment0 comments  |  Read  |  Post a Comment
WireLurker: A New Age In Mac OSX, iOS Malware
Sara Peters, Senior Editor at Dark ReadingNews
WireLurker authors are likely independent individuals based in China who are Mac development experts and cybercrime amateurs.
By Sara Peters Senior Editor at Dark Reading, 11/6/2014
Comment1 Comment  |  Read  |  Post a Comment
iOS 8 Vs. Android: How Secure Is Your Data?
Adam Ely, COO, BlueboxCommentary
With iOS 8, the lines between iOS and Android are blurring. No longer is iOS the heavily fortified environment and Android the wide-open one.
By Adam Ely COO, Bluebox, 11/5/2014
Comment4 comments  |  Read  |  Post a Comment
'Blur' Protects Against Online Tracking
Kristin Burnham, Senior Editor, InformationWeek.comNews
New tool blocks companies from tracking you online, lets you mask sensitive information such as email, phone number, and credit card information.
By Kristin Burnham Senior Editor, InformationWeek.com, 11/4/2014
Comment7 comments  |  Read  |  Post a Comment
10 Cool Security Tools Open-Sourced By The Internet's Biggest Innovators
Ericka Chickowski, Contributing Writer, Dark Reading
Google, Facebook, Netflix, and others have all offered up tools they've developed in-house to the community at large.
By Ericka Chickowski Contributing Writer, Dark Reading, 11/3/2014
Comment1 Comment  |  Read  |  Post a Comment
Facebook Adds Tor Support
Thomas Claburn, Editor-at-LargeNews
Facebook wants to allow people to use its service without being watched or censored. Is that some kind of privacy oxymoron?
By Thomas Claburn Editor-at-Large, 10/31/2014
Comment3 comments  |  Read  |  Post a Comment
The Performance Penalties of Bloatware-Based Next-Gen Firewalls
Mike Fey, EVP, GM of Corporate Products & CTO, Intel Security
Why some organizations turn off critical security features to maintain network QoS.
By Mike Fey EVP, GM of Corporate Products & CTO, Intel Security, 10/31/2014
Comment2 comments  |  Read  |  Post a Comment
Retailers Now Actively Sharing Cyberthreat Intelligence
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
The retail industry's R-CISC has been up and running for four months now and is looking for more retailers to sign up.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 10/30/2014
Comment8 comments  |  Read  |  Post a Comment
VA Buckles Down On Cyber Security, Program Management
Henry Kenyon, News
Agency refocuses IT priorities on data protection, on-time project delivery to overcome past poor performance.
By Henry Kenyon , 10/30/2014
Comment0 comments  |  Read  |  Post a Comment
Verizon Wireless Embroiled In Tracking Controversy
Kristin Burnham, Senior Editor, InformationWeek.comNews
Verizon Wireless is in hot water with security and privacy advocates regarding unique identifier headers that function as what one EFF expert calls "perma-cookies."
By Kristin Burnham Senior Editor, InformationWeek.com, 10/29/2014
Comment13 comments  |  Read  |  Post a Comment
Microsoft, Facebook Support Services A Scam, FTC Says
Kristin Burnham, Senior Editor, InformationWeek.comNews
FTC shutters company that allegedly duped consumers out of $2.5 million by falsely detecting computer viruses and selling bogus software.
By Kristin Burnham Senior Editor, InformationWeek.com, 10/27/2014
Comment5 comments  |  Read  |  Post a Comment
Open-Source Software Brings Bugs To Web Applications
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
An average of eight severe security flaws from open-source and third-party code can be found in each web application, according to new findings from Veracode.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 10/22/2014
Comment10 comments  |  Read  |  Post a Comment
Facebook Automates Fight Against Hackers
Kristin Burnham, Senior Editor, InformationWeek.comNews
Here's a sneak peek into the system Facebook uses to secure your account when other websites are hacked.
By Kristin Burnham Senior Editor, InformationWeek.com, 10/17/2014
Comment18 comments  |  Read  |  Post a Comment
Open Source v. Closed Source: What's More Secure?
Sara Peters, Senior Editor at Dark ReadingCommentaryVideo
In the wake of Shellshock and Heartbleed, has the glow of open-source application security dimmed?
By Sara Peters Senior Editor at Dark Reading, 10/17/2014
Comment6 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
DevOps’ Impact on Application Security
DevOps’ Impact on Application Security
Managing the interdependency between software and infrastructure is a thorny challenge. Often, it’s a “developers are from Mars, systems engineers are from Venus” situation.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-7839
Published: 2014-11-25
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVE-2014-8001
Published: 2014-11-25
Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

CVE-2014-8002
Published: 2014-11-25
Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?