Author

 Rafal Los, Managing Director, Solutions Research and Development, Optiv

Profile of Rafal Los

Managing Director, Solutions Research and Development, Optiv
News & Commentary Posts: 1

Rafal Los brings a blend of pragmatism and thought leadership in his approach to enterprise information security. As managing director, solutions research and development at Optiv, Los helps organizations build mature, defensible and operationally efficient security programs. Leveraging over 15 years of technical, consulting and management skills his team researches, develops and delivers program strategy frameworks, maturity models, and provides operational guidance from across industry verticals and varying maturity levels.Los previously worked at Acccuvant. Prior to that, he served as principal, strategic security services at HP Enterprise Security Services. Los developed a methodology for refocusing enterprise security programs through an assessment and threat-centric approach, directly aligning security to business value. While there, he developed new services-based offerings from concept through prototype and launch stages, and spearheaded a cross-business task team to develop new use cases for products and service offerings within the existing portfolio. Previously at HP, Los served several diverse roles including security strategist in enterprise security products where he advised customers on implementing practical solutions. He also wrote and maintained the top blog in HP Software, "Following the White Rabbit." Prior to HP, Los held various positions at GE Energy, EnterEdge Technology and Envestnet PMC.Los is an advocate for focus on sound security fundamentals and for the principles of "proportional, common sense security." He has been contributor to open standards and various organizations such as the Open Web Application Security Project (OWASP) and the Cloud Security Alliance. He has served as a speaker at conferences such as Black Hat, ISSA International, InfoSec World and many others. In addition, he maintains a regular column in SecurityWeek and contributes to other community forums. Los received his bachelor's degree in computer information systems from Concordia University.

Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20173
PUBLISHED: 2018-12-17
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
CVE-2017-18352
PUBLISHED: 2018-12-17
Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.
CVE-2017-18353
PUBLISHED: 2018-12-17
Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application.
CVE-2017-18354
PUBLISHED: 2018-12-17
Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote attacker.
CVE-2017-18355
PUBLISHED: 2018-12-17
Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "_where" attribute of package.json files.