Application Security

News & Commentary
The Security Costs of Cloud-Native Applications
Kelly Sheridan, Staff Editor, Dark ReadingNews
More than 60% of organizations report the bulk of new applications are built in the cloud. What does this mean for security?
By Kelly Sheridan Staff Editor, Dark Reading, 9/18/2018
Comment0 comments  |  Read  |  Post a Comment
Websites Attack Attempts Rose in Q2
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
New data shows hackers hit websites, on average, every 25 minutes.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 9/18/2018
Comment0 comments  |  Read  |  Post a Comment
Bomgar Buys BeyondTrust
Dark Reading Staff, Quick Hits
The companies join forces to broaden their privileged access management portfolio and will take on the BeyondTrust name.
By Dark Reading Staff , 9/13/2018
Comment0 comments  |  Read  |  Post a Comment
The Increasingly Vulnerable Software Supply Chain
Thomas Etheridge, Vice President of Services, CrowdStrikeCommentary
Nation-state adversaries from Iran to Russia have leveraged the supply chain as a vehicle to compromise infrastructure and disrupt businesses.
By Thomas Etheridge Vice President of Services, CrowdStrike, 9/13/2018
Comment0 comments  |  Read  |  Post a Comment
Modular Malware Brings Stealthy Attacks to Former Soviet States
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
A new malware technique is making phishing attacks harder to spot when they succeed.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 9/12/2018
Comment0 comments  |  Read  |  Post a Comment
New Study Details Business Benefits of Biometrics
Dark Reading Staff, Quick Hits
Biometric authentication can be good for security and for business, according to a new study from Goode Intelligence
By Dark Reading Staff , 9/12/2018
Comment0 comments  |  Read  |  Post a Comment
Mobile Attack Rates Up 24% Globally, 44% in US
Dark Reading Staff, Quick Hits
One-third of all fraud targets are mobile, a growing source of all digital transactions.
By Dark Reading Staff , 9/12/2018
Comment0 comments  |  Read  |  Post a Comment
Foreshadow, SGX & the Failure of Trusted Execution
Yehuda Lindell, Chief Scientist at Unbound Tech and Professor of Computer Science at Bar-Ilan UniversityCommentary
Trusted execution environments are said to provide a hardware-protected enclave that runs software and cannot be accessed externally, but recent developments show they fall far short.
By Yehuda Lindell Chief Scientist at Unbound Tech and Professor of Computer Science at Bar-Ilan University, 9/12/2018
Comment0 comments  |  Read  |  Post a Comment
New 'Fallout' EK Brings Return of Old Ransomware
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
The Fallout exploit kit carries GandCrab into the Middle East in a new campaign.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 9/10/2018
Comment0 comments  |  Read  |  Post a Comment
Three Trend Micro Apps Caught Collecting MacOS User Data
Kelly Sheridan, Staff Editor, Dark ReadingNews
After researchers found the security apps collecting and uploading users' browser histories, Apple removed the apps from its macOS app store and Trend Micro removed the apps' browser history collection capability.
By Kelly Sheridan Staff Editor, Dark Reading, 9/10/2018
Comment0 comments  |  Read  |  Post a Comment
GAO Says Equifax Missed Flaws, Intrusion in Massive Breach
Dark Reading Staff, Quick Hits
A report from the Government Accountability Office details the issues found and opportunities missed in the huge 2017 Equifax data breach.
By Dark Reading Staff , 9/10/2018
Comment1 Comment  |  Read  |  Post a Comment
DevOps Demystified: A Primer for Security Practitioners
John B. Dickson, CISSP,  Principal, Denim GroupCommentary
Key starting points for those still struggling to understand the concept.
By John B. Dickson CISSP, Principal, Denim Group, 9/10/2018
Comment0 comments  |  Read  |  Post a Comment
TLS 1.3 Won't Break Everything
Curtis Franklin Jr., Senior Editor at Dark ReadingCommentary
The newest version of TLS won't break everything in your security infrastructure, but you do need to be prepared for the changes it brings.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 9/7/2018
Comment0 comments  |  Read  |  Post a Comment
8 Attack Vectors Puncturing Cloud Environments
Kelly Sheridan, Staff Editor, Dark Reading
These methods may not yet be on your security team's radar, but given their impact, they should be.
By Kelly Sheridan Staff Editor, Dark Reading, 9/7/2018
Comment0 comments  |  Read  |  Post a Comment
The Best Way To Secure US Elections? Paper Ballots
Jai Vijayan, Freelance writerNews
Voting machines that do not provide a paper trail or cannot be independently audited should immediately be removed, concludes a new report from the National Academies of Sciences, Engineering, and Medicine.
By Jai Vijayan Freelance writer, 9/6/2018
Comment4 comments  |  Read  |  Post a Comment
7 Ways Blockchain is Being Used for Security
Curtis Franklin Jr., Senior Editor at Dark Reading
Blockchain is being used as a security tool. If you haven't thought about adopting it, you might want to reconsider your take.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 9/5/2018
Comment0 comments  |  Read  |  Post a Comment
PowerPool Malware Uses Windows Zero-Day Posted on Twitter
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers detected the vulnerability in an attack campaign two days after it was posted on social media.
By Kelly Sheridan Staff Editor, Dark Reading, 9/5/2018
Comment0 comments  |  Read  |  Post a Comment
The Weakest Security Links in the (Block)Chain
Drew Peck & Tim Butler, Executive Director and CEO & Founder of TegoCommentary
Despite the technology's promise to transform how business is done, there are significant limitations and potential risks at the intersection of the digital and physical worlds.
By Drew Peck & Tim Butler Executive Director and CEO & Founder of Tego, 9/5/2018
Comment1 Comment  |  Read  |  Post a Comment
Thoughts on the Latest Apache Struts Vulnerability
 Tim Mackey, Technical Evangelist, Black Duck by SynopsysCommentary
CVE-2018-11776 operates at a far deeper level within the code than all prior Struts vulnerabilities. This requires a greater understanding of the Struts code itself as well as the various libraries used by Struts.
By Tim Mackey Technical Evangelist, Black Duck by Synopsys, 9/5/2018
Comment0 comments  |  Read  |  Post a Comment
Authentication Grows Up
Kelly Sheridan, Staff Editor, Dark ReadingNews
Which forms of multi-factor authentication (MFA) are working, which are not, and where industry watchers think the market is headed.
By Kelly Sheridan Staff Editor, Dark Reading, 9/4/2018
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: In Russia, application hangs YOU!
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...
CVE-2018-16515
PUBLISHED: 2018-09-18
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
CVE-2018-16794
PUBLISHED: 2018-09-18
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.