News & Commentary

Latest Content tagged with Application Security
Page 1 / 2   >   >>
2018's Most Common Vulnerabilities Include Issues New and Old
News  |  1/18/2019  | 
The most common vulnerabilities seen last year run the gamut from cross-site scripting to issues with CMS platforms.
GDPR Suit Filed Against Amazon, Apple
Quick Hits  |  1/18/2019  | 
An Austrian non-profit, led by privacy activist and attorney Max Schrems, has filed suit against 8 tech giants for non-compliance with the EU General Data Protection Regulation.
PCI Council Releases New Software Framework for DevOps Era
News  |  1/18/2019  | 
The PCI Software Security Framework will eventually replace PCI DA-DSS when it expires in 2022.
New Attacks Target Recent PHP Framework Vulnerability
News  |  1/17/2019  | 
Multiple threat actors are using relatively simple techniques to take advantage of the vulnerability, launching cryptominers, skimmers, and other malware payloads.
Online Fraud: Now a Major Application Layer Security Problem
Commentary  |  1/15/2019  | 
The explosion of consumer-facing online services and applications is making it easier and cheaper for cybercriminals to host malicious content and launch attacks.
Former IBM Security Execs Launch Cloud Data Security Startup
News  |  1/15/2019  | 
Sonrai Security, the brainchild of two execs from IBM Security and Q1 Labs, debuts with $18.5 million in Series A funding.
Facebook Faces Action From German Watchdog
Quick Hits  |  1/14/2019  | 
German antitrust regulators prepare to require changes from Facebook regarding privacy and personal information.
Government Shutdown Brings Certificate Lapse Woes
Quick Hits  |  1/11/2019  | 
Among the problems: TLS certificates are expiring and websites are becoming inaccessible.
Who Takes Responsibility for Cyberattacks in the Cloud?
News  |  1/11/2019  | 
A new CSA report addresses the issue of breach responsibility as more organizations move ERP application data the cloud.
New Software Side-Channel Attack Raises Risk for Captured Crypto
News  |  1/10/2019  | 
The new attack hits operating systems, not chips, and may give criminals the keys to a company's cryptography.
Container Deployments Bring Security Woes at DevOps Speed
News  |  1/9/2019  | 
Nearly half of all companies know that they're deploying containers with security flaws, according to a new survey.
Cutting Through the Jargon of AI & ML: 5 Key Issues
Commentary  |  1/9/2019  | 
Ask the tough questions before you invest in artificial intelligence and machine learning technology. The security of your enterprise depends on it.
Security at the Speed of DevOps: Maturity, Orchestration, and Detection
Commentary  |  1/9/2019  | 
Container and microservices technologies, including the orchestrator Kubernetes, create an extraordinary opportunity to build infrastructure and applications that are secure by design.
Whitfield Diffie Joins Quantum Xchange Advisory Board
Quick Hits  |  1/8/2019  | 
The noted cryptography expert has joined the advisory board of the quantum key exchange provider.
Security Matters When It Comes to Mergers & Acquisitions
Commentary  |  1/8/2019  | 
The recently disclosed Marriott breach exposed a frequently ignored issue in the M&A process.
Akamai Streamlines Identity Management with Janrain Acquisition
Quick Hits  |  1/7/2019  | 
Akamai plans to combine Janrain's Identity Cloud with its Intelligent Platform to improve identity management.
Threat of a Remote Cyberattack on Today's Aircraft Is Real
Commentary  |  1/7/2019  | 
We need more stringent controls and government action to prevent a catastrophic disaster.
Start Preparing Now for the Post-Quantum Future
Commentary  |  12/28/2018  | 
Quantum computing will break most of the encryption schemes on which we rely today. These five tips will help you get ready.
Toxic Data: How 'Deepfakes' Threaten Cybersecurity
Commentary  |  12/27/2018  | 
The joining of 'deep learning' and 'fake news' makes it possible to create audio and video of real people saying words they never spoke or things they never did.
2018: The Year Machine Intelligence Arrived in Cybersecurity
News  |  12/27/2018  | 
Machine intelligence, in its many forms, began having a significant impact on cybersecurity this year setting the stage for growing intelligence in security automation for 2019.
7 Business Metrics Security Pros Need to Know
Slideshows  |  12/21/2018  | 
These days, security has to speak the language of business. These KPIs will get you started.
Unpatched Kernel-Level Vuln in IBM Security Tool for Apple MacOS Revealed
Quick Hits  |  12/21/2018  | 
Researchers disclose signedness bug in driver used by IBM Trusteer Rapport endpoint security tool after IBM fails to deliver timely patch.
Criminals Move Markets to Remain in the Shadows
News  |  12/21/2018  | 
While malware families and targets continue to evolve, the most important shift might be happening in the background.
3 Reasons to Train Security Pros to Code
News  |  12/20/2018  | 
United Health chief security strategist explains the benefits the organization reaped when it made basic coding training a requirement for security staff.
Security 101: How Businesses and Schools Bridge the Talent Gap
News  |  12/20/2018  | 
Security experts share the skills companies are looking for, the skills students are learning, and how to best find talent you need.
Attackers Use Scripting Flaw in Internet Explorer, Forcing Microsoft Patch
News  |  12/20/2018  | 
Microsoft issues an emergency update to its IE browser after researchers notified the company that a scripting engine flaw is being used to compromised systems.
US Indicts 2 APT10 Members for Years-Long Hacking Campaign
Quick Hits  |  12/20/2018  | 
In an indictment unsealed this morning, the US ties China's state security agency to a widespread campaign of personal and corporate information theft.
Automating a DevOps-Friendly Security Policy
Commentary  |  12/20/2018  | 
There can be a clash of missions between security and IT Ops teams, but automation can help.
NASA Investigating Breach That Exposed PII on Employees, Ex-Workers
News  |  12/19/2018  | 
Incident is latest manifestation of continuing security challenges at agency, where over 3,000 security incidents have been reported in recent years.
How to Remotely Brick a Server
News  |  12/19/2018  | 
Researchers demonstrate the process of remotely bricking a server, which carries serious and irreversible consequences for businesses.
Facebook Data Deals Extend to Microsoft, Amazon, Netflix
Quick Hits  |  12/19/2018  | 
An explosive new report sheds light on data-sharing deals that benefited 150 companies as Facebook handed over unknowing users' information.
Cybersecurity in 2019: From IoT & Struts to Gray Hats & Honeypots
Commentary  |  12/19/2018  | 
While you prepare your defenses against the next big thing, also pay attention to the longstanding threats that the industry still hasn't put to rest.
53 Bugs in 50 Days: Researchers Fuzz Adobe Reader
News  |  12/17/2018  | 
Automatic vulnerability finding tools detect more than 50 CVEs in Adobe Reader and Adobe Pro during a 50-day experiment.
Facebook: Photo API Bug Exposed 6.8M User Photos
Quick Hits  |  12/17/2018  | 
The flaw let developers access images that users may not have shared publicly, including those they started to upload but didnt post.
Who Are You, Really? A Peek at the Future of Identity
News  |  12/14/2018  | 
Experts dive into the trends and challenges defining the identity space and predict how online identities will change in years to come.
Retailers: Avoid the Hackable Holidaze
Commentary  |  12/14/2018  | 
The most wonderful time of the year? Sure, but not if your business and customers are getting robbed.
Universities Get Schooled by Hackers
News  |  12/13/2018  | 
Colleges and universities are prime targets for criminals due to huge sets of personal information and security that is weaker than in many businesses.
Worst Password Blunders of 2018 Hit Organizations East and West
News  |  12/12/2018  | 
Good password practices remain elusive as Dashlane's latest list of the worst password blunders can attest.
Bug Hunting Paves Path to Infosec Careers
News  |  12/12/2018  | 
Ethical hackers use bug bounty programs to build the skills they need to become security professionals.
Mac Malware Cracks WatchGuards Top 10 List
News  |  12/12/2018  | 
Hundreds of sites also still support insecure versions of the SSL encryption protocol, the security vendor reports.
Forget Shifting Security Left; It's Time to Race Left
Commentary  |  12/12/2018  | 
Once DevOps teams decide to shift left, they can finally look forward instead of backward.
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Slideshows  |  12/12/2018  | 
Constant learning is a requirement for cybersecurity professionals. Here are 15 books recommended by professionals to continue a professional's education.
Battling Bots Brings Big-Budget Blow to Businesses
News  |  12/11/2018  | 
Fighting off bot attacks on Web applications extracts a heavy cost in human resources and technology, according to a just-released report.
New Google+ Breach Will Lead to Early Service Shutdown
Quick Hits  |  12/10/2018  | 
A breach affecting more than 52 million users was patched, but not before leading to the company rethinking the future of the service.
Bringing Compliance into the SecDevOps Process
Commentary  |  12/6/2018  | 
Application security should be guided by its responsibility to maintain the confidentiality, integrity, and availability of systems and data. But often, compliance clouds the picture.
Evidence in Starwood/Marriott Breach May Point to China
Quick Hits  |  12/6/2018  | 
Attackers used methods, tools previously used by known Chinese hackers.
Starwood Breach Reaction Focuses on 4-Year Dwell
News  |  12/5/2018  | 
The unusually long dwell time in the Starwood breach has implications for both parent company Marriott International and the companies watching to learn from.
Quora Breach Exposes Information of 100 Million Users
Quick Hits  |  12/4/2018  | 
The massive breach has exposed passwords for millions who didn't remember having a Quora account.
First Lawsuits Filed in Starwood Hotels' Breach
Quick Hits  |  12/3/2018  | 
Class-action suits have been filed on behalf of guests and shareholders, with more expected.
Massive Starwood Hotels Breach Hits 500 Million Guests
News  |  11/30/2018  | 
Among the unknowns: who is behind the breach and how many of the affected records have been sold or used by criminals.
Page 1 / 2   >   >>


How the US Chooses Which Zero-Day Vulnerabilities to Stockpile
Ricardo Arroyo, Senior Technical Product Manager, Watchguard Technologies,  1/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3906
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents.
CVE-2019-3907
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password).
CVE-2019-3908
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data.
CVE-2019-3909
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.
CVE-2019-3910
PUBLISHED: 2019-01-18
Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.