Application Security
News & Commentary
Cloud Apps & Security: When Sharing Matters
Krishna Narayanaswamy, Founder & Chief Scientist, NetskopeCommentary
Sharing documents and data is happening all over the cloud today but not all sharing activity carries equal risk.
By Krishna Narayanaswamy Founder & Chief Scientist, Netskope, 8/18/2014
Comment5 comments  |  Read  |  Post a Comment
Test Drive: GFI LanGuard 2014
John H. Sawyer, Contributing Writer, Dark ReadingCommentary
LanGuard worked well in the lab and may prove more beneficial to IT operations than security teams.
By John H. Sawyer Contributing Writer, Dark Reading, 8/15/2014
Comment1 Comment  |  Read  |  Post a Comment
Why Patching Makes My Heart Bleed
John Rostern, CRISC, QSA, VP Technology Audit & Advisory Services, CoalfireCommentary
Heartbleed was a simple mistake that was allowed to propagate through "business as usual" patching cycles and change management. It could easily happen again.
By John Rostern CRISC, QSA, VP Technology Audit & Advisory Services, Coalfire, 8/14/2014
Comment2 comments  |  Read  |  Post a Comment
CloudBot: A Free, Malwareless Alternative To Traditional Botnets
Sara Peters, Senior Editor at Dark ReadingNews
Researchers take advantage of cloud service providers' free trials and lousy anti-automation controls to use cloud instances like bots.
By Sara Peters Senior Editor at Dark Reading, 8/11/2014
Comment1 Comment  |  Read  |  Post a Comment
Closing The Skills Gap Between Hackers & Defenders: 4 Steps
W. Hord Tipton, Commentary
Improvements in security education, budgets, tools, and methods will help our industry avoid more costly and dangerous attacks and data breaches in the future.
By W. Hord Tipton , 8/11/2014
Comment17 comments  |  Read  |  Post a Comment
Automakers Openly Challenged To Bake In Security
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
An open letter sent to automobile manufacturer CEOs asks carmakers to adopt a proposed five-star cyber safety program.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 8/8/2014
Comment3 comments  |  Read  |  Post a Comment
Facebook Malware: Protect Your Profile
Kristin Burnham, Senior Editor, InformationWeek.comCommentary
Malicious "Color Change" app has resurfaced on Facebook, compromising thousands of profiles. Here's what to do if you're infected.
By Kristin Burnham Senior Editor, InformationWeek.com, 8/8/2014
Comment12 comments  |  Read  |  Post a Comment
Facebook Buys Security Startup PrivateCore
Kristin Burnham, Senior Editor, InformationWeek.comCommentary
Facebook plans to deploy PrivateCore technology into its server stack to bolster encryption and malware prevention, the social network said.
By Kristin Burnham Senior Editor, InformationWeek.com, 8/8/2014
Comment0 comments  |  Read  |  Post a Comment
Google To Factor Security In Search Results
Thomas Claburn, Editor-at-LargeCommentary
Websites that don't support HTTPS connections may soon be less prominent in Google search results.
By Thomas Claburn Editor-at-Large, 8/7/2014
Comment2 comments  |  Read  |  Post a Comment
DHS-Funded 'SWAMP' Helps Scour Code For Bugs
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Cloud-based platform offering free secure coding tools for developers in government, enterprises, academia, gaining commercial attention as well.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 7/28/2014
Comment5 comments  |  Read  |  Post a Comment
Hidden iOS Services Bypass Security
Thomas Claburn, Editor-at-LargeCommentary
A computer researcher asks why Apple allows undocumented services to bypass encryption and access user data.
By Thomas Claburn Editor-at-Large, 7/21/2014
Comment13 comments  |  Read  |  Post a Comment
Active Directory Flaw Lets Attackers Change Passwords
Sara Peters, Senior Editor at Dark ReadingQuick Hits
Aorato finds way to compromise Active Directory and change passwords without being noticed by SIEM.
By Sara Peters Senior Editor at Dark Reading, 7/15/2014
Comment11 comments  |  Read  |  Post a Comment
Retro Macro Viruses: They're Baaack
Kevin Casey, Commentary
Malicious Virtual Basic for Applications (VBA) macros are back, this time using social engineering to trick users into opening infected attachments, says Sophos.
By Kevin Casey , 7/9/2014
Comment2 comments  |  Read  |  Post a Comment
Why Your Application Security Program May Backfire
Jeff Williams, CTO, Contrast SecurityCommentary
You have to consider the human factor when you’re designing security interventions, because the best intentions can have completely opposite consequences.
By Jeff Williams CTO, Contrast Security, 7/2/2014
Comment4 comments  |  Read  |  Post a Comment
Microsoft Expands Encryption, Opens First Transparency Center
Sara Peters, Senior Editor at Dark ReadingQuick Hits
As part of Microsoft's new privacy initiative, Outlook and OneDrive have also gotten encryption enhancements.
By Sara Peters Senior Editor at Dark Reading, 7/1/2014
Comment1 Comment  |  Read  |  Post a Comment
How Microsoft Cracks The BYOD Code: 3 Tips
Bret Arsenault, CISO, MicrosoftCommentary
Microsoft’s CISO shares best-practices for balancing employee autonomy and security in today’s bring-your-own world.
By Bret Arsenault CISO, Microsoft, 6/30/2014
Comment5 comments  |  Read  |  Post a Comment
Why A Secured Network Is Like The Human Body
Dan Ross, CEO & President, PromisecCommentary
It’s time to throw away the analogies about building fortresses and perimeter defenses and start to approach InfoSec with the same standard of care we use for public health.
By Dan Ross CEO & President, Promisec, 6/26/2014
Comment11 comments  |  Read  |  Post a Comment
Scope Of SAP Bugs Still Plagues Enterprises
Ericka Chickowski, Contributing Writer, Dark ReadingNews
As SAP closes its 3,000th security vulnerability, ERP experts expound on the dangers of these vulns and enterprises' continued head-in-the-sand attitude about them.
By Ericka Chickowski Contributing Writer, Dark Reading, 6/17/2014
Comment3 comments  |  Read  |  Post a Comment
Heartbleed & The Long Tail Of Vulnerabilities
Martin McKeay, Senior Security Advocate, AkamaiCommentary
To this day there are still unpatched systems, still hackers scanning for vulnerable systems, and still cyber criminals using Heartbleed every day to break into companies.
By Martin McKeay Senior Security Advocate, Akamai, 6/13/2014
Comment5 comments  |  Read  |  Post a Comment
Twitter Rules Trustworthy Websites
Kristin Burnham, Senior Editor, InformationWeek.comCommentary
Social networks scored high in a new report on website privacy and security, while news companies scored the lowest.
By Kristin Burnham Senior Editor, InformationWeek.com, 6/13/2014
Comment2 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Security Insights
DoD's Bold Initiative: Secure The User, Not The Device
DoD's Bold Initiative: Secure The User, Not The Device
Joint Information Environment effort under way to improve its ability to share information between the services, industry partners, and other government agencies
Comment1 comments
Read | Post a Comment
More Sophos Security Insights
PR Newswire
Register for Dark Reading Newsletters
White Papers
Current Issue
Cartoon
DevOps’ Impact on Application Security
DevOps’ Impact on Application Security
Managing the interdependency between software and infrastructure is a thorny challenge. Often, it’s a “developers are from Mars, systems engineers are from Venus” situation.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.