Commentary
Content posted in March 2007
When The 2 Billionth Customer Record Is Stolen, Insiders Will Be The Most Guilty
Commentary  |  3/30/2007  | 
While I was researching my next story on the danger that employees, contractors, and business partners (i.e., insiders) can place on the security of corporate data, a friend of mine sent me an interesting study that noted, among several other fascinating data points, that last year personal records were compromised at a rate of 5.8 million per month. At this rate, by the end of the year more than 2 billion records
Is The Mac More Secure Than Windows? Does It Matter?
Commentary  |  3/30/2007  | 
Is the Mac more secure than Windows, in some absolute measurement of security? And does it really matter? Senior writer Sharon Gaudin talked to a few security experts and reported the consensus that, despite a recent increase in reported security flaws, the Mac is still more secure than Windows. But it's doubtful that'll change anybody's buying decisions -- Windows users know that their software has security pr
The TJX Haul: Largest Ever AND The Perfect Crime?
Commentary  |  3/30/2007  | 
The California Secretary of State web site gets to keep it's title as number one in the race to be the longest running data breach. It left three years of files exposing personal data up online, practically for the taking. But the TJX Companies take the cake when it comes to known harm. The company has the dubious distinction of having the largest ever number of stolen credit and debit cards - 45.7 million - whi
Could This Be The 'Longest-Running Internet Breach Ever'?
Commentary  |  3/23/2007  | 
That old saw, "We're from the government, and we're here to help you," could stand some updating in this digital life. How about this one: "We're from the government, and we're here to give your identity away -- no questions asked."
Spy Agency Posts Windows, OS X Security Guides
Commentary  |  3/19/2007  | 
Who should know more about security than the National Security Agency? (Hey, it's their middle name!) No one, presumably. Which is why you might want to check out a series of security configuration guides the NSA has posted for Windows XP, 2000, Mac OS X, and Sun Solaris.
Data Safety -- The Old Fashioned Way
Commentary  |  3/15/2007  | 
We can all breathe easier. WellPoint, the country's largest managed care firm, has found its missing disk -- the unencrypted one that contains the personal information (including Social Security numbers and medical records) of 75,000 people. It had been lost in transit by UPS. But they found it. Don't you feel better?
How Will You Spend Your Patch Tuesday?
Commentary  |  3/12/2007  | 
For the first time since September 2005, 30 days will come and go without what has become a monthly ritual across the IT landscape. Patch Tuesday's reliable stream of bulletins and patches has been silenced for the time being. Is this the equivalent of a snow day for IT security pros? Or are they too burnt out from dealing with Daylight Savings Time issues to even notice?
Got Time?
Commentary  |  3/2/2007  | 
That whole time-change thing that has everyone rolling their eyes -- you know, early daylight-saving time? OK, it's not Y2K. (What could be?) And as I noted in a recent column (which goes into this issue in greater detail), no one is talking disasters of biblical proportions. But there is a little more to this than the momentary irritation of missed appointments and calendars being off an hou


Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.