News & Commentary
Latest Content
Page 1 / 2   >   >>
Heartbleed: A Password Manager Reality Check
News  |  4/18/2014  | 
Is a password manager an effective defense against vulnerabilities like Heartbleed, or are they simply another way to lose data to hackers?
Phishers Recruit Home PCs
News  |  4/18/2014  | 
Residential broadband machines spotted hosting phishing attacks.
SQL Injection Cleanup Takes Two Months or More
Quick Hits  |  4/17/2014  | 
A new report highlights the prevalence and persistence of SQL injection attacks.
Satellite Communications Wide Open To Hackers
News  |  4/17/2014  | 
Satellite terminals widely used in transportation, military, and industrial plants contain backdoors, hardcoded credentials, weak encryption algorithms, and other design flaws, a new report says.
11 Heartbleed Facts: Vulnerability Discovery, Mitigation Continue
News  |  4/17/2014  | 
Millions of websites, applications from Cisco and VMware, Google Play apps, as well as millions of Android devices are vulnerable -- and the list keeps growing.
Microsoft Delays Enterprise Windows 8.1 Support Doomsday
News  |  4/17/2014  | 
Responding to criticism, Microsoft gives businesses until August to adopt Windows 8.1 Update and continue receiving security updates. Consumers still face May 13 deadline.
How A Little Obscurity Can Bolster Security
Commentary  |  4/17/2014  | 
Most security professionals deride the idea of "security by obscurity." Is it time to re-evaluate the conventional wisdom?
Did A Faulty Memory Feature Lead To Heartbleed?
News  |  4/16/2014  | 
Debate arises over an older memory allocation feature in OpenSSL, and the OpenBSD community starts to tear down and revise the crypto software for its own use.
The Real Wakeup Call From Heartbleed
Commentary  |  4/16/2014  | 
There's nothing special about Heartbleed. Itís another flaw in a popular library that exposed a lot of servers to attack. The danger lies in the way software libraries are built and whether they can be trusted.
Mobility: Who Bears The Brunt Of Data Security & Privacy
Commentary  |  4/16/2014  | 
OS manufacturers, app developers, and consumers all have a role to play in smartphone data security. But not everyone is equally responsible.
Don't Blame It On The Web Programming Platform
Quick Hits  |  4/15/2014  | 
New data shows no one Web development platform generates more vulnerabilities than another -- and website security is still a problem.
White House Details Zero-Day Bug Policy
News  |  4/15/2014  | 
NSA denies prior knowledge of the Heartbleed vulnerability, but the White House reserves the right to withhold zero-day exploit information in some cases involving security or law enforcement.
Black Hat USA 2014: Pentesting? Thought You'd Never Ask
Event Updates  |  4/15/2014  | 
If Black Hat USA 2014 isn't quite around the corner, it's definitely on the horizon, and the team is hard at work putting together this year's programming.
Active Directory Is Dead: 3 Reasons
Commentary  |  4/15/2014  | 
These days, Active Directory smells gangrenous to innovative companies born in the cloud and connecting customers, employees, and partners across devices at light speed.
Heartbleed's Intranet & VPN Connection
News  |  4/14/2014  | 
How the game-changing crypto bug affects internal servers, clients, and VPN networks -- and what to do about it.
Akamai Withdraws Proposed Heartbleed Patch
News  |  4/14/2014  | 
As researchers demonstrate OpenSSL bug exploits that retrieve private keys, Akamai rescinds a patch suggestion for the SSL/TLS library after a security researcher punches holes in it.
'Baby Teeth' In Infrastructure Cyber Security Framework
Commentary  |  4/14/2014  | 
NISTís modest effort to improve lax security around IT infrastructure in airports, utilities, and other critical areas now heads to Congress. Don't hold your breath.
Iranian-Based Cyberattack Activity On The Rise, Mandiant Report Says
News  |  4/11/2014  | 
New report details the rise of suspected Iranian and Syrian-based cyber-attacks.
Free Heartbleed-Checker Released for Firefox Browser
Quick Hits  |  4/11/2014  | 
Browser plug-ins arrive for Firefox and Chrome that scan websites for Heartbleed risk
Windows XP Alive & Well in ICS/SCADA Networks
News  |  4/10/2014  | 
End-of-life for XP support not raising many red flags in critical infrastructure environments, where patching is the exception.
Heartbleed Will Go On Even After The Updates
News  |  4/10/2014  | 
What's next now that the mindset is 'assume the worst has already occurred?'
Flash Poll: Broken Heartbeat
Commentary  |  4/10/2014  | 
What steps do you plan to take in response to the Heartbleed bug? Take our poll and share your reasons in the comments.
Heartbleed: Examining The Impact
Commentary  |  4/10/2014  | 
With Heartbleed, thereís little hope of knowing if an asset was breached, if a breach can be identified, or what, if any, data was leaked. Hereís how to defend against future attacks.
CIO Vs. CSO: Allies Or Enemies?
Commentary  |  4/10/2014  | 
In the wake of the Target breach it's clear that the CIO and CSO must have clear boundaries of responsibility and equal representation in the board room.
Majority Of Users Have Not Received Security Awareness Training, Study Says
Quick Hits  |  4/10/2014  | 
Many users fail to follow policies on mobile, cloud security, EMA Research study says.
More Than A Half-Million Servers Exposed To Heartbleed Flaw
News  |  4/9/2014  | 
What the newly exposed SSL/TLS threat really means for enterprises and end-users.
Whatís Worse: Credit Card Or Identity Theft?
Commentary  |  4/9/2014  | 
When it comes to data loss, itís time for the conversation to shift from credit cards to personal information like Social Security numbers, home addresses, and your favorite flavor of ice cream.
Emergency SSL/TLS Patching Under Way
News  |  4/8/2014  | 
A "Heartbleed" flaw revealed in the OpenSSL library leaks the contents of memory, including passwords, source code, and keys.
One Year Later: The APT1 Report
Commentary  |  4/8/2014  | 
One of the most positive impacts of APT1 is the undeniable rise in the stature of the threat intelligence industry. "Threat Intelligence" is the SIEM, the NAC of 2014.
Operation Stop the Exfiltration
News  |  4/7/2014  | 
Determined cybercriminals and cyberspies will find their way to the data they want, but there are ways to trip them up as they try to make their way out.
Social Engineering Grows Up
News  |  4/7/2014  | 
Fifth annual DEF CON Social Engineering Capture the Flag Contest kicks off today with new "tag team" rules to reflect realities of the threat.
If Mother Nature Were A CISO
Commentary  |  4/7/2014  | 
There are many defensive patterns in nature that also apply to information security. Here's how to defeat your predators in the high-stakes game of corporate survival and resiliency.
We Are the Perimeter
Guest Blogs  |  4/7/2014  | 
End users, not technology, define the boundaries of the enterprise. Security strategies must protect this new perimeter.
Tech Insight: Making Data Classification Work
Commentary  |  4/4/2014  | 
Data classification involves much more than simply buying a product and dropping it in place. Here are some dos and don'ts.
Advanced Attacks Are The New Norm, Study Says
Quick Hits  |  4/4/2014  | 
According to the Websense 2014 Threat Report, most malicious exploits now are advanced and targeted.
Nominum: 24 Million Home Routers Exposing ISPs to DDoS Attacks
News  |  4/4/2014  | 
Even Internet service providers that go to great lengths to protect their networks are vulnerable.
NSAís Big Surprise: Govít Agency Is Actually Doing Its Job
Commentary  |  4/4/2014  | 
When people claimed after 9/11 that the NSA was ill equipped to deal with a changing world, I wonder what they expected to happen.
Advanced Persistent Threats: What Are They, Really?
Advanced Persistent Threats: What Are They, Really?
Dark Reading Videos  |  4/4/2014  | 
There seem to be as many definitions of APT as there are actual APTs. So what is an advanced persistent threat, really?
Study: Security Fears Continue To Block Cloud Deployment
Quick Hits  |  4/3/2014  | 
'Fear of the unknown' still haunts cloud adoption.
API-First: 3 Steps For Building Secure Cloud Apps
Commentary  |  4/3/2014  | 
When it comes to protecting data traveling to and from the cloud, today's choices are daunting. Here are three steps for making the application programming interface your new best friend.
What Is The FIDO Alliance?
What Is The FIDO Alliance?
Dark Reading Videos  |  4/2/2014  | 
Phillip Dunkelberger of Nok Nok Labs explains why its proposed specifications will transform computing.
Extra, Extra: What's New With Dark Reading News & Analysis
Commentary  |  4/2/2014  | 
How to share your opinion, news tips, and ideas.
The Right Stuff: Staffing Your Corporate SOC
Commentary  |  4/2/2014  | 
What makes a top-notch security analyst? Passion, experience, and communication skills trump certifications and degrees. But you get what you pay for.
Cyber Criminals Operate On A Budget, Too
Quick Hits  |  4/1/2014  | 
New report shines light on how attacks have gotten more advanced but still basically use some of the same old, same old, tools
Be Careful Beating Up Target
Commentary  |  4/1/2014  | 
Target was actually better prepared than most retailers. The real problem lies with the current state of industry threat intelligence and IR practices.
Researchers: RSA Adopted Second Tool That Might Have Helped NSA Surveillance
Quick Hits  |  4/1/2014  | 
RSA adopted a technology extension for secure websites that may have allowed faster cracking of RSAís flawed Dual Elliptic Curve.
Wickr Spreads Its 'Leave No Trace' Messaging
News  |  4/1/2014  | 
Privacy-conscious messaging technology now offered to other social media, messaging providers.
Community & A Virtual Handshake
Commentary  |  3/31/2014  | 
A secret handshake means you are part of a shared experience. That's what the Dark Reading community is all about.
Bit Errors & the Internet of Things
Commentary  |  3/31/2014  | 
Internet traffic, misdirected to malicious bitsquatted domains, has plagued computer security for years. The consequences will be even worse for the IoT.
Top Advice for CISOs
Top Advice for CISOs
Dark Reading Videos  |  3/31/2014  | 
Some of the soft skills are the hardest ones for CISOs to deploy.
Page 1 / 2   >   >>


Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Containing Corporate Data on Mobile Devices
Containing Corporate Data on Mobile Devices
If youíre still focused on securing endpoints, youíve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-3154
Published: 2014-04-17
DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file conte...

CVE-2013-2143
Published: 2014-04-17
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.

CVE-2014-0036
Published: 2014-04-17
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.

CVE-2014-0054
Published: 2014-04-17
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External ...

CVE-2014-0071
Published: 2014-04-17
PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.

Best of the Web