Database Security
Authentication
Privacy
Compliance
Careers & People
Identity & Access Management
Threat Intelligence
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
What Government Can (And Can't) Do About Cybersecurity
Could The Sony Attacks Happen Again? Join The Conversation
Why Russia Hacks
2015: The Year Of The Security Startup – Or Letdown
Cartoon: End-User Ed
News & Commentary
NFL Mobile Vulnerable Super Bowl-Sized Vulns
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Lack of protections puts users at risk of exposed information by way of man-in-the-middle attacks.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/27/2015
Comment0 comments  |  Read  |  Post a Comment
Gas Stations Urged To Secure Internet-Exposed Fuel Tank Devices
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Researchers find more than 5,000 US gas stations' automated tank gauges unprotected on the public Internet and open to hackers.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/26/2015
Comment5 comments  |  Read  |  Post a Comment
Power Consumption Technology Could Help Enterprises Identify Counterfeit Devices
Tim Wilson, Editor in Chief, Dark ReadingCommentary
Understanding a device's "power fingerprint" might make it possible to detect security anomalies in Internet of Things as well, startup says
By Tim Wilson Editor in Chief, Dark Reading, 1/26/2015
Comment1 Comment  |  Read  |  Post a Comment
Security Skills Shortage? Don’t Panic!
Carric Dooley, WW VP of Foundstone Services, Intel Security
Focus your energies on building a comprehensive security strategy and turning to experts for guidance.
By Carric Dooley WW VP of Foundstone Services, Intel Security, 1/26/2015
Comment1 Comment  |  Read  |  Post a Comment
Adobe Fixes Second Flash Flaw Exploited By Angler
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Second 0-day fix addresses UAF vulnerability.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/26/2015
Comment0 comments  |  Read  |  Post a Comment
Building A Cybersecurity Program: 3 Tips
Jason Sachowski, Senior Forensic Investigator, ScotiabankCommentary
Getting from “we need” to “we have” a cybersecurity program is an investment in time and resources that’s well worth the effort.
By Jason Sachowski Senior Forensic Investigator, Scotiabank, 1/26/2015
Comment1 Comment  |  Read  |  Post a Comment
Growing Open Source Use Heightens Enterprise Security Risks
Jai Vijayan, Freelance writerNews
Companies often have little clue about the extent of third-party code in the enterprise or the risks it poses, security experts say
By Jai Vijayan Freelance writer, 1/23/2015
Comment9 comments  |  Read  |  Post a Comment
Why Russia Hacks
Mike Walls, Managing Director Security Operations & Analysis, EdgeWaveCommentary
Conventional wisdom holds that Russia hacks primarily for financial gain. But equally credible is the belief that the Russians engage in cyberwarfare to further their geopolitical ambitions.
By Mike Walls Managing Director Security Operations & Analysis, EdgeWave, 1/23/2015
Comment16 comments  |  Read  |  Post a Comment
Diverse White Hat Community Leads To Diverse Vuln Disclosures
Sara Peters, Senior Editor at Dark ReadingNews
Researchers at Penn State find that courting new bug hunters is just as important as rewarding seasoned ones.
By Sara Peters Senior Editor at Dark Reading, 1/22/2015
Comment6 comments  |  Read  |  Post a Comment
The Internet of Abused Things
Liviu Arsene, Senior E-threat Analyst, Bitdefender
We need to find ways to better secure the Internet of Things, or be prepared to face the consequences.
By Liviu Arsene Senior E-threat Analyst, Bitdefender, 1/22/2015
Comment0 comments  |  Read  |  Post a Comment
NSA Report: How To Defend Against Destructive Malware
Kelly Jackson Higgins, Executive Editor at Dark ReadingQuick Hits
In the wake of the Sony breach, spy agency's Information Assurance Directorate (IAD) arm provides best practices to mitigate damage of data annihilation attacks.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/22/2015
Comment3 comments  |  Read  |  Post a Comment
What Government Can (And Can’t) Do About Cybersecurity
Jeff Williams, CTO, Aspect Security & Contrast SecurityCommentary
In his 2015 State of the Union address, President Obama introduced a number of interesting, if not terribly novel, proposals. Here are six that will have minimal impact.
By Jeff Williams CTO, Aspect Security & Contrast Security, 1/22/2015
Comment17 comments  |  Read  |  Post a Comment
Protect Yourself by Protecting Others
Candace Worley, SVP & GM, Endpoint Security Business, Intel Security
How the consumerization of IT is affecting endpoint security.
By Candace Worley SVP & GM, Endpoint Security Business, Intel Security, 1/22/2015
Comment0 comments  |  Read  |  Post a Comment
President's Plan To Crack Down On Hacking Could Hurt Good Hackers
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Security experts critical of President Obama's new proposed cybersecurity legislation.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/21/2015
Comment9 comments  |  Read  |  Post a Comment
Security Budgets Going Up, Thanks To Mega-Breaches
Sara Peters, Senior Editor at Dark ReadingNews
Sixty percent of organizations have increased their security spending by one-third -- but many security managers still don't think that's enough, Ponemon study finds.
By Sara Peters Senior Editor at Dark Reading, 1/21/2015
Comment5 comments  |  Read  |  Post a Comment
Adobe Investigating New Flash Zero-Day Spotted In Crimeware Kit
Kelly Jackson Higgins, Executive Editor at Dark ReadingQuick Hits
Researcher Kafeine's 0day discovery confirmed by Malwarebytes.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/21/2015
Comment2 comments  |  Read  |  Post a Comment
Facebook Messenger: Classically Bad AppSec
Daniel Riedel, CEO, New ContextCommentary
Facebook offers a textbook example of what the software industry needs to do to put application security in the forefront of software development.
By Daniel Riedel CEO, New Context, 1/21/2015
Comment2 comments  |  Read  |  Post a Comment
Could The Sony Attacks Happen Again? Join The Conversation
Tim Wilson, Editor in Chief, Dark ReadingCommentary
Check out Dark Reading Radio's interview and live chat with CrowdStrike founder and CEO George Kurtz and Shape Security executive Neal Mueller.
By Tim Wilson Editor in Chief, Dark Reading, 1/21/2015
Comment13 comments  |  Read  |  Post a Comment
Ransomware Leads Surge In 2014 Mobile Malware Onslaught
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Mobile malware increases 75 percent in U.S.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/20/2015
Comment3 comments  |  Read  |  Post a Comment
'123456' & 'Password' Are The 2 Most Common Passwords, Again
Sara Peters, Senior Editor at Dark ReadingQuick Hits
New entrants to the top 25 show that bad password creators are fans of sports, superheroes, dragons, and NSFW numeral combos.
By Sara Peters Senior Editor at Dark Reading, 1/20/2015
Comment3 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
15th Member of Washington, D.C.-Based Identity Theft Ring Pleads Guilty
SolarWinds Survey Investigates Insider Threats to Federal Cybersecurity
Ad Networks Just Got More Secure
Bitglass Breach Discovery Limits Damage From Data Breaches
Adroit Digital Study Reveals Consumer Data Privacy and Security Concerns as President Obama Talks Cybersecurity in State of the Union
Updated for 2015: Tools Designed to Manage Third Party Risk
Vormetric’s 2015 Insider Threat Report: 93% of U.S. Organizations Polled Vulnerable to Insider Threats
Online Trust Alliance Determines Over 90 Percent of Data Breaches in First Half of 2014 Could Have Been Easily Prevented
More Products & Releases
PR Newswire
What Government Can (And Can't) Do About Cybersecurity
Jeff Williams, CTO, Aspect Security & Contrast Security,  1/22/2015
Why Russia Hacks
Mike Walls, Managing Director Security Operations & Analysis, EdgeWave,  1/23/2015
Could The Sony Attacks Happen Again? Join The Conversation
Tim Wilson, Editor in Chief, Dark Reading,  1/21/2015
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Security Skills Shortage? Don't Panic!
Focus your energies on building a comprehensive security strategy and turning to experts for guidance. Read >>
Partner Perspectives
What's This?
The Internet of Abused Things
We need to find ways to better secure the Internet of Things, or be prepared to face the consequences. Read >>
Cartoon
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.
White Papers
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8148
Published: 2015-01-26
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

CVE-2014-8157
Published: 2015-01-26
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVE-2014-8158
Published: 2015-01-26
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVE-2014-9571
Published: 2015-01-26
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

CVE-2014-9572
Published: 2015-01-26
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Best of the Web
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Flash Poll
Video
Slideshows
Twitter Feed