Commentary
Content posted in May 2014
Flash Poll: The Hunt For Cyber Talent
Commentary  |  5/30/2014  | 
Our latest flash poll paints a nuanced picture of how the security skills shortage is playing out in hiring strategies for the SOC.
Indicting Chinese Military Officers Is A Huge Mistake
Commentary  |  5/29/2014  | 
Blaming soldiers following lawful orders only deflects from the government's responsibility to impose trade sanctions and take more useful measures.
Dissecting Dendroid: An In-Depth Look Inside An Android RAT Kit
Commentary  |  5/28/2014  | 
Dendroid is full of surprises to assist it in subverting traditional security tactics through company-issued Android phones or BYOD.
Dark Reading Radio: The Real Reason Security Jobs Remain Vacant
Commentary  |  5/27/2014  | 
Join us Wednesday, May 28, at 1:00 p.m. Eastern, to learn why good security staff really are not hard to find, if you know what to look for.
eBay Breach: Is Your Identity Up For Auction?
Commentary  |  5/23/2014  | 
In a sick twist of events, the roles may just have been reversed on eBay users. Its their social media identities and data that now have the greatest value in the cyber underground.
Women In Security: We've Still Got A Long Way To Go, Baby
Commentary  |  5/23/2014  | 
Research shows that the gender gap in IT remains a real problem, but getting girls interested in technology is not the issue.
The Only 2 Things Every Developer Needs To Know About Injection
Commentary  |  5/22/2014  | 
Theres no simple solution for preventing injection attacks. There are effective strategies that can stop them in their tracks.
Why Security & Profitability Go Hand-In-Hand
Commentary  |  5/21/2014  | 
Its never been more critical to put security on the front line to protect your company's bottom line.
Dark Reading To Launch Weekly Internet Radio Show
Commentary  |  5/20/2014  | 
DR Radio will take place every Wednesday at 1:00 p.m. ET and will feature live chat; first topic will be "A Day in the Life of a Penetration Tester."
6 Tips For Securing Social Media In The Workplace
Commentary  |  5/20/2014  | 
Empower employees by training them to be aware and secure, and in how to avoid becoming a statistic.
How To Talk About InfoSec To Your Board Of Directors
Commentary  |  5/19/2014  | 
Today's cybersecurity challenges cannot be met by a compartmentalized IT strategy because every piece of the modern enterprise runs on connectivity and data.
Tech Insight: Free Tools For Offensive Security
Commentary  |  5/19/2014  | 
A professional penetration tester offers a look at the latest free and open-source tools available for pen testing and offensive tactics.
Apple Picking: 5 Ways to Lose (& Retrieve) Mac Data
Commentary  |  5/16/2014  | 
Apple platforms are far from invincible, as these common loss scenarios demonstrate.
Beware Cognitive Bias
Commentary  |  5/15/2014  | 
Cognitive bias can compromise any profession. But when cognitive bias goes unrecognized in cyber security, far-reaching and serious consequences follow.
Dispelling The Myths Of Cyber Security
Commentary  |  5/14/2014  | 
Perfect security that focuses on eliminating threats is too expensive and impossible to achieve. Better to think about consequence management.
Infographic: The Story Of A Phish
Commentary  |  5/13/2014  | 
Are your employees like Troy, blissfully unaware of the dangers of spear phishing?
Into The Breach: The Limits Of Data Security Technology
Commentary  |  5/12/2014  | 
When it comes to cyberdefense spending, the smart money should bet on people and compliance as much as on machines.
A New Approach to Endpoint Security: Think Positive
Commentary  |  5/9/2014  | 
It's time to move away from traditional blacklisting models that define what should be restricted and implicitly allow everything else.
The Cyber Security Market Is Hot! Heres Why
Commentary  |  5/8/2014  | 
A dozen years ago the $3.5 billion security market was dominated by five vendors. Last year, VCs bankrolled 230 startups. My, how things have changed!
Why Threat Intelligence Is Like Teenage Sex
Commentary  |  5/7/2014  | 
Everyone thinks everyone else is doing it, and most of the few people who are actually doing it aren't doing it all that well.
NextGen Authentication: There's A Really Smart Phone In Your Future
Commentary  |  5/6/2014  | 
The mobile device is the latest platform to reinvent access controls, and it's putting enterprise IT back in the driver's seat of security and data protection.
Flash Poll: Your Take On The IT Security Skills Gap
Commentary  |  5/6/2014  | 
How would you describe the posture of your companys current security team and hiring practices? Take our new poll.
Defending Against Identity Theft In The Military
Commentary  |  5/5/2014  | 
Our military troops are twice as likely to be victims of identity theft as the general population. The reason is in the structure of military culture.
Why Perimeter Defenses Are No Longer Enough
Commentary  |  5/2/2014  | 
When it comes to corporate information security and data protection, the new normal is "due care" in managing day-to-day operations.
How To Avoid Sloppy Authentication
Commentary  |  5/1/2014  | 
Viewing authentication as a process, not simply as an encryption or algorithm, is the key to defending corporate resources from attacks.
Dark Reading Celebrates Eighth Anniversary
Commentary  |  5/1/2014  | 
Now the web's largest online info security community, Dark Reading's 2006 charter hasn't changed: to help security pros do their jobs.


Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: No, you were supposed to display UNICODE characters!
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.