Risk // Compliance
News & Commentary
Federal IT Security Policies Must Be User Friendly
James Bindseil, Commentary
Federal agencies should choose security tools and policies that suit the productivity needs of their employees.
By James Bindseil , 4/16/2014
Comment2 comments  |  Read  |  Post a Comment
White House Details Zero-Day Bug Policy
Mathew J. Schwartz, News
NSA denies prior knowledge of the Heartbleed vulnerability, but the White House reserves the right to withhold zero-day exploit information in some cases involving security or law enforcement.
By Mathew J. Schwartz , 4/15/2014
Comment3 comments  |  Read  |  Post a Comment
Feds Address Antitrust Concerns On Cyberthreat Sharing
William Jackson, Technology WriterCommentary
Justice Dept. and FTC confirm that sharing cybersecurity threat information is not an antitrust law violation.
By William Jackson Technology Writer, 4/11/2014
Comment3 comments  |  Read  |  Post a Comment
Paul Allen Invests In Online Voting Firm
Elena Malykhina, Technology JournalistCommentary
E-voting firm Scytl receives $40 million from Paul Allen's Vulcan Capital to continue election modernization efforts. Defense Department among its customers.
By Elena Malykhina Technology Journalist, 4/9/2014
Comment5 comments  |  Read  |  Post a Comment
Colleagues In Cuffs: When Employees Steal Patient Records
Alison Diana, Senior EditorCommentary
The Queens County DA recently arrested two Jamaica Hospital employees for stealing patient data, a lucrative crime occurring at hospitals across the nation.
By Alison Diana Senior Editor, 4/7/2014
Comment15 comments  |  Read  |  Post a Comment
March Madness: Online Privacy Edition
Mark Weinstein, Founder & CEO, SgrouplesCommentary
Say hello to the privacy revolution where an emerging backlash is being spurred by NSA spying, mass data collection and plain old common sense.
By Mark Weinstein Founder & CEO, Sgrouples, 3/26/2014
Comment1 Comment  |  Read  |  Post a Comment
Target, PCI Auditor Trustwave Sued By Banks
Mathew J. Schwartz, News
Trustwave apparently certified the retailer as PCI compliant -- but can PCI assessors be held liable for data breaches?
By Mathew J. Schwartz , 3/26/2014
Comment11 comments  |  Read  |  Post a Comment
Windows XP Security Issues: Fact Vs. Fiction
Michael Endler, Associate Editor, InformationWeek.comNews
Are you prepared for the end of Microsoft support for Windows XP next month?
By Michael Endler Associate Editor, InformationWeek.com, 3/12/2014
Comment2 comments  |  Read  |  Post a Comment
Security Services Cater To SMBs
Robert Lemos, Technology JournalistNews
Cloud and managed security services are headed down market with simpler interfaces masking their enterprise heritage
By Robert Lemos Technology Journalist, 3/11/2014
Comment0 comments  |  Read  |  Post a Comment
Compliance Is Not Hard
Glenn S. Phillips, Commentary
Compliance requires a new set of healthy habits and the self-discipline to make those habits stick
By Glenn S. Phillips , 2/26/2014
Comment1 Comment  |  Read  |  Post a Comment
Microsoft Beefs Up EMET
Kelly Jackson Higgins, Senior Editor, Dark ReadingQuick Hits
Early release of anti-exploit tool shuts down bypass methods created by Bromium Labs
By Kelly Jackson Higgins Senior Editor, Dark Reading, 2/25/2014
Comment2 comments  |  Read  |  Post a Comment
FIDO Alliance Publishes Authentication Standards; First Products Unveiled
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
FIDO Alliance issues specs for "authentication plumbing;" Nok Nok ships first implementation
By Tim Wilson Editor in Chief, Dark Reading, 2/17/2014
Comment1 Comment  |  Read  |  Post a Comment
The Mysterious Appearance Of An Anti-Theft Application
Kelly Jackson Higgins, Senior Editor, Dark ReadingQuick Hits
Kaspersky Lab researchers discover on their machines Absolute Software Computrace anti-theft application -- but they had not installed it
By Kelly Jackson Higgins Senior Editor, Dark Reading, 2/13/2014
Comment1 Comment  |  Read  |  Post a Comment
Locking Down E-Mail With Security Services
Robert Lemos, Technology JournalistNews
Companies are increasingly looking to the cloud for services to encrypt, back up, and archive their e-mail to protect from accidental leakage and intentional disruption
By Robert Lemos Technology Journalist, 2/12/2014
Comment2 comments  |  Read  |  Post a Comment
Javelin Study: A New Identity Fraud Victim Every Two Seconds
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
Javelin report says identity fraud increased to 13.1 million victims in 2013
By Tim Wilson Editor in Chief, Dark Reading, 2/6/2014
Comment0 comments  |  Read  |  Post a Comment
NAC Comes Back
Kelly Jackson Higgins, Senior Editor, Dark ReadingNews
BYOD and advanced malware help resuscitate network access control
By Kelly Jackson Higgins Senior Editor, Dark Reading, 2/5/2014
Comment2 comments  |  Read  |  Post a Comment
Chip-and-PIN Security Push To Pit Retailers Against Banks
Robert Lemos, Technology JournalistNews
While the cost of breaches typically falls on the merchants, card issuers and banks would foot much of the bill for improving the security of the payment-card system
By Robert Lemos Technology Journalist, 1/30/2014
Comment2 comments  |  Read  |  Post a Comment
Securing The Distributed Network Perimeter
Robert Lemos, Technology JournalistNews
A variety of cloud and managed services can be used to lock down the rapidly expanding corporate network perimeter
By Robert Lemos Technology Journalist, 1/28/2014
Comment0 comments  |  Read  |  Post a Comment
Secret Service Investigating Breach At Michael's Retail Chain
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
Retail giant Michael's still has not disclosed source or scope of breach; Secret Service called in
By Tim Wilson Editor in Chief, Dark Reading, 1/28/2014
Comment0 comments  |  Read  |  Post a Comment
Startup Tackles Security Through Microsoft Active Directory
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
New company Aorato identifies potential threats by monitoring traffic from ubiquitous Active Directory
By Tim Wilson Editor in Chief, Dark Reading, 1/23/2014
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by Marilyn Cohodas
Current Conversations LOL.
In reply to: Check out our new cartoon
Post Your Own Reply
More Conversations
Register for Dark Reading Newsletters
White Papers
Latest Comment: LOL.
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-04-17
DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:, 1:0.134.x before 1:, 1:0.142.x before 1:, 1:0.150.x before 1:, and 1:0.152.x before 1: does not properly create temporary files, which allows local users to obtain the XAUTHORITY file conte...

Published: 2014-04-17
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.

Published: 2014-04-17
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.

Published: 2014-04-17
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External ...

Published: 2014-04-17
PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.

Best of the Web