Author

 Stephen Scharf
LinkedIn
RSS
E-Mail

Profile of Stephen Scharf

The Depository Trust & Clearing Corporation
Member Since: 11/8/2016
Author
News & Commentary Posts: 1
Comments: 0

Stephen Scharf is chief security officer at The Depository Trust & Clearing Corporation (DTCC<http://www.dtcc.com/#_blank>). In this role he is responsible for centralizing and aligning the firm's global information security, physical security, employee safety, and crisis/incident management functions, ensuring a comprehensive and holistic approach to risk management and resilience across the organization.

Scharf comes from Experian where he served as global chief information security officer, accountable for the overall strategy, leadership and governance of Experian's global information security, physical security and business continuity programs. Prior to that Scharf was global chief security officer for Bloomberg, LP. and managing security architect for security consulting firm @stake.

Scharf has over twenty years of experience in information technology with a 15 year concentration in information security. He has achieved the Certified Information Systems Security Professional (CISSP), and previously held certifications as Microsoft Certified Systems Engineer (MCSE), Checkpoint Certified Systems Engineer (CCSE), and Cisco Certified Network Administrator (CCNA). He is a regular speaker at security events, including talks at the United Nations. Scharf has also authored multiple articles on security topics, including forensics, security administration, business continuity planning, and outsourcing. In 2012 Scharf was honored as CSO of the Year by SC Magazine.

Scharf received a Bachelor of Arts degree from Ithaca College with a major in History and a minor in English.

Articles by Stephen Scharf
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
8 Security Tips to Gift Your Loved Ones For the Holidays
Steve Zurier, Freelance Writer,  12/18/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20228
PUBLISHED: 2018-12-19
Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.
CVE-2018-20230
PUBLISHED: 2018-12-19
An issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVE-2018-20231
PUBLISHED: 2018-12-19
Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.
CVE-2018-20227
PUBLISHED: 2018-12-19
RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.
CVE-2018-19790
PUBLISHED: 2018-12-18
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restricti...