Risk // Compliance
News & Commentary
Report: Some Retail Firms Still Don't Recognize Cyber Security Risks
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
Nearly 10 percent of retail firms have not reported any cyber security exposure to the SEC since 2011, Willis Group says.
By Tim Wilson Editor in Chief, Dark Reading, 4/24/2014
Comment2 comments  |  Read  |  Post a Comment
Federal IT Security Policies Must Be User Friendly
James Bindseil, President & CEO, GlobalscapeCommentary
Federal agencies should choose security tools and policies that suit the productivity needs of their employees.
By James Bindseil President & CEO, Globalscape, 4/16/2014
Comment2 comments  |  Read  |  Post a Comment
White House Details Zero-Day Bug Policy
Mathew J. Schwartz, News
NSA denies prior knowledge of the Heartbleed vulnerability, but the White House reserves the right to withhold zero-day exploit information in some cases involving security or law enforcement.
By Mathew J. Schwartz , 4/15/2014
Comment3 comments  |  Read  |  Post a Comment
Feds Address Antitrust Concerns On Cyberthreat Sharing
William Jackson, Technology WriterCommentary
Justice Dept. and FTC confirm that sharing cybersecurity threat information is not an antitrust law violation.
By William Jackson Technology Writer, 4/11/2014
Comment3 comments  |  Read  |  Post a Comment
Paul Allen Invests In Online Voting Firm
Elena Malykhina, Technology JournalistCommentary
E-voting firm Scytl receives $40 million from Paul Allen's Vulcan Capital to continue election modernization efforts. Defense Department among its customers.
By Elena Malykhina Technology Journalist, 4/9/2014
Comment6 comments  |  Read  |  Post a Comment
Colleagues In Cuffs: When Employees Steal Patient Records
Alison Diana, Senior EditorCommentary
The Queens County DA recently arrested two Jamaica Hospital employees for stealing patient data, a lucrative crime occurring at hospitals across the nation.
By Alison Diana Senior Editor, 4/7/2014
Comment16 comments  |  Read  |  Post a Comment
March Madness: Online Privacy Edition
Mark Weinstein, Founder & CEO, SgrouplesCommentary
Say hello to the privacy revolution where an emerging backlash is being spurred by NSA spying, mass data collection and plain old common sense.
By Mark Weinstein Founder & CEO, Sgrouples, 3/26/2014
Comment1 Comment  |  Read  |  Post a Comment
Target, PCI Auditor Trustwave Sued By Banks
Mathew J. Schwartz, News
Trustwave apparently certified the retailer as PCI compliant -- but can PCI assessors be held liable for data breaches?
By Mathew J. Schwartz , 3/26/2014
Comment11 comments  |  Read  |  Post a Comment
Windows XP Security Issues: Fact Vs. Fiction
Michael Endler, Associate Editor, InformationWeek.comNews
Are you prepared for the end of Microsoft support for Windows XP next month?
By Michael Endler Associate Editor, InformationWeek.com, 3/12/2014
Comment2 comments  |  Read  |  Post a Comment
Security Services Cater To SMBs
Robert Lemos, Technology JournalistNews
Cloud and managed security services are headed down market with simpler interfaces masking their enterprise heritage
By Robert Lemos Technology Journalist, 3/11/2014
Comment0 comments  |  Read  |  Post a Comment
Compliance Is Not Hard
Glenn S. Phillips, Commentary
Compliance requires a new set of healthy habits and the self-discipline to make those habits stick
By Glenn S. Phillips , 2/26/2014
Comment1 Comment  |  Read  |  Post a Comment
Microsoft Beefs Up EMET
Kelly Jackson Higgins, Senior Editor, Dark ReadingQuick Hits
Early release of anti-exploit tool shuts down bypass methods created by Bromium Labs
By Kelly Jackson Higgins Senior Editor, Dark Reading, 2/25/2014
Comment2 comments  |  Read  |  Post a Comment
FIDO Alliance Publishes Authentication Standards; First Products Unveiled
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
FIDO Alliance issues specs for "authentication plumbing;" Nok Nok ships first implementation
By Tim Wilson Editor in Chief, Dark Reading, 2/17/2014
Comment1 Comment  |  Read  |  Post a Comment
The Mysterious Appearance Of An Anti-Theft Application
Kelly Jackson Higgins, Senior Editor, Dark ReadingQuick Hits
Kaspersky Lab researchers discover on their machines Absolute Software Computrace anti-theft application -- but they had not installed it
By Kelly Jackson Higgins Senior Editor, Dark Reading, 2/13/2014
Comment1 Comment  |  Read  |  Post a Comment
Locking Down E-Mail With Security Services
Robert Lemos, Technology JournalistNews
Companies are increasingly looking to the cloud for services to encrypt, back up, and archive their e-mail to protect from accidental leakage and intentional disruption
By Robert Lemos Technology Journalist, 2/12/2014
Comment2 comments  |  Read  |  Post a Comment
Javelin Study: A New Identity Fraud Victim Every Two Seconds
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
Javelin report says identity fraud increased to 13.1 million victims in 2013
By Tim Wilson Editor in Chief, Dark Reading, 2/6/2014
Comment0 comments  |  Read  |  Post a Comment
NAC Comes Back
Kelly Jackson Higgins, Senior Editor, Dark ReadingNews
BYOD and advanced malware help resuscitate network access control
By Kelly Jackson Higgins Senior Editor, Dark Reading, 2/5/2014
Comment2 comments  |  Read  |  Post a Comment
Chip-and-PIN Security Push To Pit Retailers Against Banks
Robert Lemos, Technology JournalistNews
While the cost of breaches typically falls on the merchants, card issuers and banks would foot much of the bill for improving the security of the payment-card system
By Robert Lemos Technology Journalist, 1/30/2014
Comment2 comments  |  Read  |  Post a Comment
Securing The Distributed Network Perimeter
Robert Lemos, Technology JournalistNews
A variety of cloud and managed services can be used to lock down the rapidly expanding corporate network perimeter
By Robert Lemos Technology Journalist, 1/28/2014
Comment0 comments  |  Read  |  Post a Comment
Secret Service Investigating Breach At Michael's Retail Chain
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
Retail giant Michael's still has not disclosed source or scope of breach; Secret Service called in
By Tim Wilson Editor in Chief, Dark Reading, 1/28/2014
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by Marilyn Cohodas
Current Conversations LOL.
In reply to: Check out our new cartoon
Post Your Own Reply
More Conversations
Register for Dark Reading Newsletters
White Papers
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web