News & Commentary
Latest Content tagged with Application Security
Page 1 / 2   >   >>
IT-OT Convergence: Coming to an Industrial Plant Near You
Commentary  |  4/25/2017  | 
There's been a big divide between IT and OT, but that must end. Here's how to make them come together.
Best Practices for Securing Open Source Code
Commentary  |  4/21/2017  | 
Attackers see open source components as an obvious target because there's so much information on how to exploit them. These best practices will help keep you safer.
Cutting through the Noise: Is It AI or Pattern Matching?
Commentary  |  4/20/2017  | 
Many vendors are fudging terms when trying to sell their artificial intelligence security systems. Here's what you need to know when you buy.
Join Dark Reading for a 4/20 Twitter Chat on AppSec
Commentary  |  4/19/2017  | 
The @DarkReading team will host a conversation about application security on 4/20 at 2 p.m. ET.
The Second Coming of Managed File Transfer Has Arrived
Commentary  |  4/17/2017  | 
Sometimes, a mature, embedded technology still makes the most sense, especially when it comes to data security.
Cybersecurity & Fitness: Weekend Warriors Need Not Apply
Commentary  |  4/12/2017  | 
It takes consistency and a repeatable but flexible approach to achieve sustainable, measurable gains in both disciplines.
OWASP Top 10 Update: Long Overdue Or Same-Old, Same-Old?
News  |  4/11/2017  | 
The industry benchmark list is about to change for the first time in four years, but barring a few important changes, it looks a lot like it always has.
Tax Season Surprise: W-2 Fraud
Commentary  |  4/11/2017  | 
W-2 fraud used to target businesses exclusively but has now set its sights on many other sectors. Here's what you can do to prevent it from happening to you.
Computer Engineer Charged with Theft of Proprietary Computer Code
Quick Hits  |  4/11/2017  | 
Zhengquan Zhang arrested for stealing over 3 million files containing company trade secrets from his employer, a global finance firm.
The New Shadow IT: Custom Data Center Applications
Commentary  |  4/7/2017  | 
If you think youve finally gotten control of unsanctioned user apps, think again. The next wave of rogue apps is on its way from your data center to the cloud.
Matching Wits with a North Korea-Linked Hacking Group
News  |  4/5/2017  | 
Skilled 'Bluenoroff' arm of infamous Lazarus hacking team behind Bangladesh Bank heist and Sony attacks actively resists investigators on its trail, Kaspersky Lab says.
FCC Privacy Rule Repeal Will Have Widespread Security Implications
News  |  4/4/2017  | 
Concerns over the action are sending VPN sales soaring, some vendors say.
Cybercriminals Seized Control of Brazilian Bank for 5 Hours
News  |  4/4/2017  | 
Sophisticated heist compromised major bank's entire DNS infrastructure.
To Attract and Retain Better Employees, Respect Their Data
Commentary  |  4/3/2017  | 
A lack of privacy erodes trust that employees should have in management.
Russian-Speaking APT Recycles Code Used in '90s Cyberattacks Against US
News  |  4/3/2017  | 
Researchers discover connection between Turla cyber espionage gang and wave of attacks against US government agencies in the 1990's.
Customized Malware: Confronting an Invisible Threat
Commentary  |  3/31/2017  | 
Hackers are gaining entry to networks through a targeted approach. It takes a rigorous defense to keep them out.
US Border Policy Shifts May Drive Changes in Laptop Security
News  |  3/31/2017  | 
In-cabin laptop ban and requirements to unlock devices for border patrol could have enterprises revisiting their on-device data policies.
Payment Card Industry Security Compliance: What You Need to Know
Commentary  |  3/30/2017  | 
A quick refresher on all the different PCI SSC security standards that are relevant for organizations that accept electronic payments.
To Gain Influence, CISOs Must Get Security's Human Element Right
Commentary  |  3/29/2017  | 
Focusing on certain elements of security in isolation can cause a false sense of security.
7 Steps to Transforming Yourself into a DevSecOps Rockstar
Slideshows  |  3/23/2017  | 
Security practitioners at one education software firm offer lessons learned from merging DevOps with security.
Phishing Your Employees for Schooling & Security
Commentary  |  3/22/2017  | 
Your education program isn't complete until you test your users with fake phishing emails.
The True State of DevSecOps
News  |  3/21/2017  | 
Automation improving, but security needs to find ways to slide into DevOps workflow and toolchain.
New Wave of Security Acquisitions Signals Start of Consolidation Trend
Slideshows  |  3/20/2017  | 
A dozen recent high-profile deals reflect cybersecurity vendors' hopes of expanding their offerings with next-generation technology, ideas, and talent.
ERP Attack Risks Come into Focus
News  |  3/16/2017  | 
New highly critical SAP vulnerability highlights dangers against critical business software.
Google Removes Chamois Apps Botnet from Play Store
Quick Hits  |  3/16/2017  | 
Google has eliminated Chamois apps, which installed invisible apps and downloaded unwanted plugins without victims' knowledge.
Twitter Counter Hack Uses Familiar Attack Mode
News  |  3/15/2017  | 
Experts advise users to be more aware of the potential downside of third-party apps.
Security in the Age of Open Source
Commentary  |  3/15/2017  | 
Dramatic changes in the use of open source software over the past decade demands major changes in security testing regimens today. Here's what you need to know and do about it.
WhatsApp, Telegram Flaw Gives Hackers Full Account Access
Quick Hits  |  3/15/2017  | 
A new vulnerability discovered in popular messaging services like WhatsApp and Telegram lets hackers assume complete control over accounts.
The Industrial Revolution of Application Security
Commentary  |  3/14/2017  | 
DevOps is driving big changes in the industry, but a cultural shift is needed.
What Your SecOps Team Can (and Should) Do
Commentary  |  3/13/2017  | 
If your organization has all of these pieces in place, congratulations!
IoT & Liability: How Organizations Can Hold Themselves Accountable
Commentary  |  3/10/2017  | 
To avoid a lawsuit, your company needs to better understand the state of your infrastructure and the devices and applications within it. Here are five areas on which to focus.
Financial Institutions Less AppSec-Savvy Than You'd Think
News  |  3/10/2017  | 
New study shows banks all have policies in place, but lack metrics and good third-party software controls.
Securing Todays 'Elastic Attack Surface'
Commentary  |  3/9/2017  | 
The foundation of good cybersecurity is knowing your network. But as organizations embrace new technologies, that simple task has gotten incredibly difficult.
In a Cybersecurity Vendor War, the End User Loses
Commentary  |  3/8/2017  | 
When vulnerability information is disclosed without a patch available, users are the ones really being punished.
A Real-Life Look into Responsible Disclosure for Security Vulnerabilities
Commentary  |  3/7/2017  | 
A researcher gives us a glimpse into what happened when he found a problem with an IoT device.
Veracode Snapped Up by CA Technologies in $614 Million Deal
Quick Hits  |  3/6/2017  | 
CA acquisition of app security firm to close in the first quarter of fiscal year 2018.
Users Can Now Time Their Windows 10 Updates
Quick Hits  |  3/6/2017  | 
Microsoft gives option to users to fix security update schedule within three days of notification.
HackerOne Offers Free Service for Open Source Projects
Quick Hits  |  3/3/2017  | 
Service aims to provide efficient security programs but projects must meet certain rules to qualify for it.
Three Years after Heartbleed, How Vulnerable Are You?
Commentary  |  3/2/2017  | 
You may have a problem lurking in your open source components and not know it. Start making a list...
Zones of Trust: A New Way of Thinking about IoT Security
Commentary  |  2/28/2017  | 
Recent attacks have focused attention on how to safely add "things"to enterprise networks, a topic that straddles IT and physical security. A zones-of-trust approach may be the answer.
Google's Ease-of-Use Email Encryption Project Goes Open Source
News  |  2/27/2017  | 
E2Email, together with open source Key Transparency project, are meant to take on the challenges that have dogged end-to-end email encryption adoption for decades.
Microsoft Adds Technical Updates to SDL Site
Quick Hits  |  2/27/2017  | 
Microsoft releases a new round of updates and technical content additions to its Security Development Lifecycle website.
How to Secure Hyperconverged Infrastructures & Why It Is Different
Partner Perspectives  |  2/23/2017  | 
The next-generation datacenter requires new security practices, but that doesnt mean everything we learned about datacenter security becomes obsolete.
Tunneling Through The "Walls" Of IoT In The Enterprise
Commentary  |  2/22/2017  | 
The movie "Die Hard" has a thing or two to teach us about the pitfalls of the Internet of Things.
Preparing Security For Windows 7 End-Of-Life Support
Commentary  |  2/21/2017  | 
Moving to Microsoft's latest OS may give you flashbacks to when XP support ended.
Controlling Privileged Access To Prevent Rogue Users In Active Directory
Commentary  |  2/20/2017  | 
Knowing which of your employees have which privileges is the first step to staying safe.
Keep Employees Secure, Wherever They Are
Commentary  |  2/10/2017  | 
As workers grow more dispersed, organizations need to focus on three areas to maintain security.
Harvest Season: Why Cyberthieves Want Your Compute Power
Commentary  |  2/9/2017  | 
Attackers are hijacking compute power in order to pull off their other crimes.
What to Watch (& Avoid) At RSAC
Commentary  |  2/8/2017  | 
A renowned security veteran shares his RSA dance card, offering views on technologies destined for the dustbin of history and those that will move the industry forward.
Enterprise Android Vs iOS: Which is More Secure?
Commentary  |  2/7/2017  | 
The answer is not as simple as you think. A mobile security expert parses the pros and cons.
Page 1 / 2   >   >>


Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.