News & Commentary
Latest Content
Page 1 / 2   >   >>
FBI Offering $4.3 Million For Help Finding Cyber Most-Wanted
Quick Hits  |  7/2/2015  | 
Big prize still going to whomever can help find Gameover ZeuS mastermind.
Harvard Suffers Data Breach Spanning Multiple Schools, Administration Networks
News  |  7/2/2015  | 
Investigation so far shows email and system login info may have been compromised, university says.
In The Cyber Realm, Letís Be Knights Not Blacksmiths
Commentary  |  7/2/2015  | 
Why the Internet of Things is our chance to finally get information security right.
Smart Cities' 4 Biggest Security Challenges
News  |  7/1/2015  | 
The messiness of politics and the vulnerability of the Internet of Things in one big, unwieldy package.
PCI Update Paves Way For Expanding Point-to-Point Encryption
News  |  7/1/2015  | 
Move appears designed mainly for large organizations and big-box retailers looking to lock down payment card security.
Franchising Ransomware
Partner Perspectives  |  7/1/2015  | 
Ransomware-as-a-service is fueling cyberattacks. Is your organization prepared?
Why We Need In-depth SAP Security Training
Commentary  |  7/1/2015  | 
SAP and Oracle are releasing tons of patches every month, but are enterprises up to this complex task? I have my doubts.
DDoS Attackers Exploiting '80s-Era Routing Protocol
News  |  7/1/2015  | 
Latest wave of DDoS attacks abuses small office-home routers via the 27-year-old, outdated Routing Information Protocol Version 1 (RIPv1).
Android Malware On The Rise
News  |  7/1/2015  | 
By the end of 2015, researchers expect the number of new Android malware strains to hit 2 million.
Securing Critical Infrastructure
Partner Perspectives  |  6/30/2015  | 
Protecting the Industrial Internet of Things from cyberthreats is a national priority.
Cisco 'Everywhere': Networking Giant To Buy OpenDNS For $635 Million
Quick Hits  |  6/30/2015  | 
OpenDNS, which provides threat intelligence via a software-as-a-service offering, expected to enhance Cisco's existing cloud security offerings.
Getting To Yes: Negotiating Technology Innovation & Security Risk
Commentary  |  6/30/2015  | 
As enterprises look for ways to leverage the cloud, mobility, Big Data, and social media for competitive advantage, CISOs can no longer give blanket refusals to IT experimentation.
4 Signs Your Board Thinks Security Readiness Is Better Than It Is
News  |  6/30/2015  | 
Ponemon Institute survey shows a gap in perception between boards of directors and IT executives when it comes to IT risk posture.
Gas Stations In the Bullseye
News  |  6/29/2015  | 
White hats at Black Hat USA will release free honeypot tool for monitoring attacks against gas tank monitoring systems.
Clever CryptoWall Spreading Via New Attacks
News  |  6/29/2015  | 
Top ransomware doesn't waste time jumping on the latest Flash zero-day, and hops rides on click fraud campaigns, too.
CSA Announces New Working Group For Cloud Security API Standards
News  |  6/29/2015  | 
CipherCloud, Deloitte, InfoSys, Intel Security and SAP all on board to start developing vendor-neutral guidelines that could further accelerate CASB growth
Cyber Resilience And Spear Phishing
Partner Perspectives  |  6/29/2015  | 
Balanced security capability, defense in depth, integrated countermeasures, and a threat-intelligence strategy are critical to defending your business from spear-phishing attacks.
Social Engineering & Black Hat: Do As I Do Not As I Say
Commentary  |  6/29/2015  | 
Yes, I will be at Black Hat, where people will yell at me about NOT giving my PII to anyone, especially if they ask me for it via email.
4 Ways Cloud Usage Is Putting Health Data At Risk
News  |  6/26/2015  | 
A huge shadow IT problem is just one of the risks of uncontrolled cloud usage in healthcare organizations, new study shows.
3 Simple Steps For Minimizing Ransomware Exposure
Commentary  |  6/26/2015  | 
If your data is important enough to pay a ransom, why wasn't it important enough to properly backup and protect in the first place?
Stealthy Fobber Malware Takes Anti-Analysis To New Heights
News  |  6/25/2015  | 
Built off the Tinba banking Trojan and distributed through the elusive HanJuan exploit kit, Fobber info-stealer defies researchers with layers upon layers of encryption.
FireEye Report Prompts Reported SEC Probe Of FIN4 Hacking Gang
News  |  6/25/2015  | 
Security vendor's report from last year had warned about group targeting insider data from illegal trading.
5 Things You Probably Missed In The Verizon DBIR
Slideshows  |  6/25/2015  | 
A look at a few of the lesser-noticed but meaty nuggets in the annual Verizon Data Breach Investigations Report (DBIR).
What Do You Mean My Security Tools Donít Work on APIs?!!
Commentary  |  6/25/2015  | 
SAST and DAST scanners havenít advanced much in 15 years. But the bigger problem is that they were designed for web apps, not to test the security of an API.
Breach Defense Playbook: Cybersecurity Governance
Partner Perspectives  |  6/25/2015  | 
Time to leave the island: Integrate cybersecurity into your risk management strategy.
How To Avoid Collateral Damage In Cybercrime Takedowns
News  |  6/24/2015  | 
Internet pioneer and DNS expert Paul Vixie says 'passive DNS' is way to shut down malicious servers and infrastructure without affecting innocent users.
Breach Defense Playbook: Incident Response Readiness (Part 2)
Partner Perspectives  |  6/24/2015  | 
Will your incident response plan work when a real-world situation occurs?
User Monitoring Not Keeping Up With Risk Managers' Needs
News  |  6/24/2015  | 
Biggest concern is negligence, but monitoring capabilities can't detect this type of activity within most applications.
FBI: CryptoWall Ransomware Cost US Users $18 Million
News  |  6/24/2015  | 
Increasing pace of ransomware innovation likely to keep that number going up.
Why China Wants Your Sensitive Data
Commentary  |  6/24/2015  | 
Since May 2014, the Chinese government has been amassing a 'Facebook for human intelligence.' Here's what it's doing with the info.
The Secret Of War Lies In The Communications --Napoleon
Partner Perspectives  |  6/24/2015  | 
DXL helps organizations keep an eye on external and internal threats using relevant information in real time.
Child Exploitation & Assassins For Hire On The Deep Web
News  |  6/23/2015  | 
'Census report' of the unindexed parts of the Internet unearths everything from Bitcoin-laundering services to assassins for hire.
Banks Targeted By Hackers Three Times More Than Other Sectors
News  |  6/23/2015  | 
Active targeted attacks on financial services firms in quest for lucrative data -- and of course, money.
Breach Defense Playbook: Incident Response Readiness (Part 1)
Partner Perspectives  |  6/23/2015  | 
Will your incident response plan work when a real-world situation occurs?
Government, Healthcare Particularly Lackluster In Application Security
News  |  6/23/2015  | 
Veracode's State of Software Security Report lays out industry-specific software security metrics.
The Dark Web: An Untapped Source For Threat Intelligence
Commentary  |  6/23/2015  | 
Most organizations already have the tools for starting a low-cost, high-return Dark Web cyber intelligence program within their existing IT and cybersecurity teams. Hereís how.
3 Clues That Collaboration And File Sharing Tools Are Cloud Security's Weak Link
News  |  6/23/2015  | 
Cloud collaboration and file sharing applications continue to raise CISOs' blood pressure.
Report: NSA, GCHQ Actively Targeted Kaspersky Lab, Other Security Vendors
Quick Hits  |  6/22/2015  | 
Snowden documents reveal government intelligence agencies were working to subvert security software. Kaspersky Lab calls nation-states' targeting of security companies 'extremely worrying.'
FitBit, Acer Liquid Leap Fail In Security Fitness
News  |  6/22/2015  | 
Transmissions to the cloud are secured with these Internet of Things devices, but wristband-to-phone comms are open to eavesdropping.
What You Probably Missed In Verizon's Latest DBIR
Commentary  |  6/22/2015  | 
Tune in to Dark Reading Radio at 1pm ET/11am Pacific on Wednesday, June 24, when Verizon Data Breach Investigations Report co-author Marc Spitler discusses some of the possibly lesser-noticed nuggets in the industry's popular report on real-world attacks.
Breach Defense Playbook: Open Source Intelligence
Partner Perspectives  |  6/22/2015  | 
Do you know what information out there is putting you at risk?
Security Surveys: Read With Caution
Commentary  |  6/22/2015  | 
Iím skeptical of industry surveys that tell security practitioners what they already know. Donít state the obvious. Tell us the way forward.
US Hosts The Most Botnet Servers
News  |  6/19/2015  | 
More malicious command and control servers are based in the US than anywhere else, and China is home to the most bots.
7 Top Security Quotes From London Technology Week
Slideshows  |  6/19/2015  | 
Tech events across the city hit on IoT, smart cities, mobility and Legos.
9 Questions For A Healthy Application Security Program
Commentary  |  6/19/2015  | 
Teams often struggle with building secure software because fundamental supporting practices aren't in place. But those practices don't require magic, just commitment.
An Effective Community Is More Than Just An Online Forum
Partner Perspectives  |  6/19/2015  | 
It is important to develop a strong base of contributors who can communicate effectively, answer questions, and summarize issues.
Houston Astros' Breach A 'Wake-Up Call' On Industrial Cyber Espionage
News  |  6/18/2015  | 
The St. Louis Cardinals' alleged breach of the Astros' proprietary database raises concern over the possibility of US companies hacking their rivals for intel.
New Apple iOS, OS X Flaws Pose Serious Risk
News  |  6/18/2015  | 
Security vulnerabilities could expose passwords for Apple iCloud, email, and bank accounts, and other sensitive information, researchers say.
Breach Defense Playbook: Reviewing Your Cybersecurity Program (Part 2)
Partner Perspectives  |  6/18/2015  | 
Cybersecurity requires a combination of people, process, and technology in a coordinated implementation leveraging a defense-in-depth methodology.
Cybersecurity Advice From A Former White House CIO
Commentary  |  6/18/2015  | 
Today's playbook demands 'human-centered' user education that assumes people will share passwords, forget them, and do unsafe things to get their jobs done.
Page 1 / 2   >   >>


Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0543
Published: 2015-07-05
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2015-0544
Published: 2015-07-05
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.

CVE-2015-2721
Published: 2015-07-05
Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attacke...

CVE-2015-2722
Published: 2015-07-05
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a shared worker.

CVE-2015-2724
Published: 2015-07-05
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code v...

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report