Commentary

Content posted in September 2012
The Plural Of Data Is Not Analytics
Commentary  |  9/30/2012  | 
When it comes to security monitoring, searching and reporting aren’t always enough. The added value comes from analytics: turning data into information
Security Intelligence = Table Stakes
Commentary  |  9/25/2012  | 
Smart security practitioners know they can no longer rely on their vendors to provide the intelligence they need to deal with today's attacks
Launching An IAM Project: Where To Start
Commentary  |  9/21/2012  | 
How to think architecture-centric, not audit-centric, in identity and access
A Look At Encrypted Query Processing
Commentary  |  9/20/2012  | 
Stupid encryption tricks, only without a funny YouTube video
How Cybercriminals Choose Their Targets
Commentary  |  9/14/2012  | 
Attackers look for companies with poor defenses and a lack of security skills, so no business, not even an SMB, is immune.
What Identity And Access Management Can Learn From 'Car Talk'
Commentary  |  9/10/2012  | 
Compliance-driven IAM results in the enterprise staring at a Chinese menu of options, and all they can do is point to one that they partially understand
Great, Now We Have To Pee In The Boat
Commentary  |  9/10/2012  | 
Spontaneous reactions can create unintended and costly compliance issues
Flash First: Your Next Storage Strategy?
Commentary  |  9/5/2012  | 
As flash storage costs decline, its performance advantages over hard drives become even more appealing.
Talking 'Bout My Reputation
Commentary  |  9/1/2012  | 
When good security monitoring means not believing everything you're told


Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12557
PUBLISHED: 2018-06-19
An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could ...
CVE-2018-12559
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequ...
CVE-2018-12560
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.
CVE-2018-12561
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.
CVE-2018-12562
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).