Database Security
Authentication
Privacy
Compliance
Careers & People
Identity & Access Management
Threat Intelligence
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
NFL Mobile Sports App Contains Super Bowl-Sized Vulns
Gas Stations Urged To Secure Internet-Exposed Fuel Tank Devices
What Government Can (And Can't) Do About Cybersecurity
Why Russia Hacks
Cartoon: End-User Ed
News & Commentary
Why Iran Hacks
Mike Walls, Managing Director Security Operations & Analysis, EdgeWaveCommentary
Iran is using its increasingly sophisticated cyber capabilities to minimize Western influence and establish itself as the dominant power in the Middle East.
By Mike Walls Managing Director Security Operations & Analysis, EdgeWave, 1/29/2015
Comment0 comments  |  Read  |  Post a Comment
'Ghost' Not So Scary After All
Kelly Jackson Higgins, Executive Editor at Dark ReadingQuick Hits
The latest open-source Linux vulnerability is serious but some security experts say it's not that easy to abuse and use in an attack.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/28/2015
Comment3 comments  |  Read  |  Post a Comment
Small Changes Can Make A Big Difference In Tech Diversity
Lysa Myers, Security Researcher, ESETCommentary
There’s no doubt that many employers feel most comfortable hiring people like themselves. But in InfoSec, this approach can lead to stagnation.
By Lysa Myers Security Researcher, ESET, 1/28/2015
Comment1 Comment  |  Read  |  Post a Comment
Half Of Enterprises Worldwide Hit By DDoS Attacks, Report Says
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
New data illustrates how distributed denial-of-service (DDoS) attacks remain a popular attack weapon -- and continue to evolve.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/27/2015
Comment2 comments  |  Read  |  Post a Comment
WiIl Millennials Be The Death Of Data Security?
Chris Rouland, Founder & CEO, BastilleCommentary
Millennials, notoriously promiscuous with data and devices, this year will become the largest generation in the workforce. Is your security team prepared?
By Chris Rouland Founder & CEO, Bastille, 1/27/2015
Comment24 comments  |  Read  |  Post a Comment
NFL Mobile Sports App Contains Super Bowl-Sized Vulns
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Lack of protections puts users at risk of exposed information by way of man-in-the-middle attacks.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/27/2015
Comment8 comments  |  Read  |  Post a Comment
Gas Stations Urged To Secure Internet-Exposed Fuel Tank Devices
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Researchers find more than 5,000 US gas stations' automated tank gauges unprotected on the public Internet and open to hackers.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/26/2015
Comment9 comments  |  Read  |  Post a Comment
Power Consumption Technology Could Help Enterprises Identify Counterfeit Devices
Tim Wilson, Editor in Chief, Dark ReadingCommentary
Understanding a device's "power fingerprint" might make it possible to detect security anomalies in Internet of Things as well, startup says
By Tim Wilson Editor in Chief, Dark Reading, 1/26/2015
Comment1 Comment  |  Read  |  Post a Comment
Security Skills Shortage? Don’t Panic!
Carric Dooley, WW VP of Foundstone Services, Intel Security
Focus your energies on building a comprehensive security strategy and turning to experts for guidance.
By Carric Dooley WW VP of Foundstone Services, Intel Security, 1/26/2015
Comment5 comments  |  Read  |  Post a Comment
Adobe Fixes Second Flash Flaw Exploited By Angler
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Second 0-day fix addresses UAF vulnerability.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/26/2015
Comment1 Comment  |  Read  |  Post a Comment
Building A Cybersecurity Program: 3 Tips
Jason Sachowski, Senior Forensic Investigator, ScotiabankCommentary
Getting from “we need” to “we have” a cybersecurity program is an investment in time and resources that’s well worth the effort.
By Jason Sachowski Senior Forensic Investigator, Scotiabank, 1/26/2015
Comment6 comments  |  Read  |  Post a Comment
Growing Open Source Use Heightens Enterprise Security Risks
Jai Vijayan, Freelance writerNews
Companies often have little clue about the extent of third-party code in the enterprise or the risks it poses, security experts say
By Jai Vijayan Freelance writer, 1/23/2015
Comment10 comments  |  Read  |  Post a Comment
Why Russia Hacks
Mike Walls, Managing Director Security Operations & Analysis, EdgeWaveCommentary
Conventional wisdom holds that Russia hacks primarily for financial gain. But equally credible is the belief that the Russians engage in cyberwarfare to further their geopolitical ambitions.
By Mike Walls Managing Director Security Operations & Analysis, EdgeWave, 1/23/2015
Comment16 comments  |  Read  |  Post a Comment
Diverse White Hat Community Leads To Diverse Vuln Disclosures
Sara Peters, Senior Editor at Dark ReadingNews
Researchers at Penn State find that courting new bug hunters is just as important as rewarding seasoned ones.
By Sara Peters Senior Editor at Dark Reading, 1/22/2015
Comment6 comments  |  Read  |  Post a Comment
The Internet of Abused Things
Liviu Arsene, Senior E-threat Analyst, Bitdefender
We need to find ways to better secure the Internet of Things, or be prepared to face the consequences.
By Liviu Arsene Senior E-threat Analyst, Bitdefender, 1/22/2015
Comment0 comments  |  Read  |  Post a Comment
NSA Report: How To Defend Against Destructive Malware
Kelly Jackson Higgins, Executive Editor at Dark ReadingQuick Hits
In the wake of the Sony breach, spy agency's Information Assurance Directorate (IAD) arm provides best practices to mitigate damage of data annihilation attacks.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/22/2015
Comment3 comments  |  Read  |  Post a Comment
What Government Can (And Can’t) Do About Cybersecurity
Jeff Williams, CTO, Aspect Security & Contrast SecurityCommentary
In his 2015 State of the Union address, President Obama introduced a number of interesting, if not terribly novel, proposals. Here are six that will have minimal impact.
By Jeff Williams CTO, Aspect Security & Contrast Security, 1/22/2015
Comment18 comments  |  Read  |  Post a Comment
Protect Yourself by Protecting Others
Candace Worley, SVP & GM, Endpoint Security Business, Intel Security
How the consumerization of IT is affecting endpoint security.
By Candace Worley SVP & GM, Endpoint Security Business, Intel Security, 1/22/2015
Comment0 comments  |  Read  |  Post a Comment
President's Plan To Crack Down On Hacking Could Hurt Good Hackers
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Security experts critical of President Obama's new proposed cybersecurity legislation.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/21/2015
Comment9 comments  |  Read  |  Post a Comment
Security Budgets Going Up, Thanks To Mega-Breaches
Sara Peters, Senior Editor at Dark ReadingNews
Sixty percent of organizations have increased their security spending by one-third -- but many security managers still don't think that's enough, Ponemon study finds.
By Sara Peters Senior Editor at Dark Reading, 1/21/2015
Comment5 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
IBM Research Announces Cloud Breakthrough For Protecting Personal Data
ZeroFOX Acquires Vulnr
Proofpoint Releases Enterprise Protection Suite 8.0, Advances Email Security Leadership
Virtru Announces General Availability of its Encrypted Email and Digital Privacy Service
Ed Survey Results: Insider Threats
Verizon Announces Security Enhancement for IoT Deployments
New Patent Eliminates Passwords
CYBERTECH SPONSORING “DATA PRIVACY DAY 2015: SECURING THE INTERNET OF THINGS” NATIONAL SEMINAR
More Products & Releases
PR Newswire
WiIl Millennials Be The Death Of Data Security?
Chris Rouland, Founder & CEO, Bastille,  1/27/2015
Why Russia Hacks
Mike Walls, Managing Director Security Operations & Analysis, EdgeWave,  1/23/2015
Growing Open Source Use Heightens Enterprise Security Risks
Jai Vijayan, Freelance writer,  1/23/2015
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Security Skills Shortage? Don't Panic!
Focus your energies on building a comprehensive security strategy and turning to experts for guidance. Read >>
Partner Perspectives
What's This?
How to Save Time and Protect Your Smart Home
New technology can help secure the digitized home, from tablets and laptops to smart appliances and thermostats. Read >>
Cartoon
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.
White Papers
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0236
Published: 2015-01-29
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

CVE-2015-1422
Published: 2015-01-29
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) j...

CVE-2015-1423
Published: 2015-01-29
Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.

CVE-2015-1424
Published: 2015-01-29
Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.

CVE-2014-8893
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) mainpage.jsp and (2) GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Best of the Web
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Flash Poll
Video
Slideshows
Twitter Feed