Database Security
Authentication
Privacy
Compliance
Careers & People
Identity & Access Management
Threat Intelligence
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
NFL Mobile Sports App Contains Super Bowl-Sized Vulns
Small Changes Can Make A Big Difference In Tech Diversity
Why Iran Hacks
Gas Stations Urged To Secure Internet-Exposed Fuel Tank Devices
Cartoon: End-User Ed
News & Commentary
Google Paid Over $1.5 Million In Bug Bounties In 2014
Kelly Jackson Higgins, Executive Editor at Dark ReadingQuick Hits
Mobile apps developed by Google now included in its Vulnerability Reward Program.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/30/2015
Comment3 comments  |  Read  |  Post a Comment
How The Skills Shortage Is Killing Defense in Depth
David Holmes, World-Wide Security Evangelist, F5Commentary
It used to be easy to sell specialized security gizmos but these days when a point product gets pitched to a CSO, the response is likely “looks nifty, but I don’t have the staff to deploy it.”
By David Holmes World-Wide Security Evangelist, F5, 1/30/2015
Comment7 comments  |  Read  |  Post a Comment
Takeaways from International Data Privacy Day: The Internet of Things
Lorie Wigle, Vice President, General Manager IOT Security Solutions, Intel Security Group
Event looks at the future of data use and how we can – and should – protect personal privacy.
By Lorie Wigle Vice President, General Manager IOT Security Solutions, Intel Security Group, 1/30/2015
Comment0 comments  |  Read  |  Post a Comment
ZeroAccess Click-Fraud Botnet Back In Action Again
Sara Peters, Senior Editor at Dark ReadingNews
After a six-month hiatus, the much-diminished P2P botnet is up to its old tricks.
By Sara Peters Senior Editor at Dark Reading, 1/29/2015
Comment1 Comment  |  Read  |  Post a Comment
Why Iran Hacks
Mike Walls, Managing Director Security Operations & Analysis, EdgeWaveCommentary
Iran is using its increasingly sophisticated cyber capabilities to minimize Western influence and establish itself as the dominant power in the Middle East.
By Mike Walls Managing Director Security Operations & Analysis, EdgeWave, 1/29/2015
Comment7 comments  |  Read  |  Post a Comment
'Ghost' Not So Scary After All
Kelly Jackson Higgins, Executive Editor at Dark ReadingQuick Hits
The latest open-source Linux vulnerability is serious but some security experts say it's not that easy to abuse and use in an attack.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/28/2015
Comment5 comments  |  Read  |  Post a Comment
Small Changes Can Make A Big Difference In Tech Diversity
Lysa Myers, Security Researcher, ESETCommentary
There’s no doubt that many employers feel most comfortable hiring people like themselves. But in InfoSec, this approach can lead to stagnation.
By Lysa Myers Security Researcher, ESET, 1/28/2015
Comment2 comments  |  Read  |  Post a Comment
Half Of Enterprises Worldwide Hit By DDoS Attacks, Report Says
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
New data illustrates how distributed denial-of-service (DDoS) attacks remain a popular attack weapon -- and continue to evolve.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/27/2015
Comment2 comments  |  Read  |  Post a Comment
WiIl Millennials Be The Death Of Data Security?
Chris Rouland, Founder & CEO, BastilleCommentary
Millennials, notoriously promiscuous with data and devices, this year will become the largest generation in the workforce. Is your security team prepared?
By Chris Rouland Founder & CEO, Bastille, 1/27/2015
Comment32 comments  |  Read  |  Post a Comment
NFL Mobile Sports App Contains Super Bowl-Sized Vulns
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Lack of protections puts users at risk of exposed information by way of man-in-the-middle attacks.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/27/2015
Comment10 comments  |  Read  |  Post a Comment
Gas Stations Urged To Secure Internet-Exposed Fuel Tank Devices
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Researchers find more than 5,000 US gas stations' automated tank gauges unprotected on the public Internet and open to hackers.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/26/2015
Comment10 comments  |  Read  |  Post a Comment
Power Consumption Technology Could Help Enterprises Identify Counterfeit Devices
Tim Wilson, Editor in Chief, Dark ReadingCommentary
Understanding a device's "power fingerprint" might make it possible to detect security anomalies in Internet of Things as well, startup says
By Tim Wilson Editor in Chief, Dark Reading, 1/26/2015
Comment1 Comment  |  Read  |  Post a Comment
Security Skills Shortage? Don’t Panic!
Carric Dooley, WW VP of Foundstone Services, Intel Security
Focus your energies on building a comprehensive security strategy and turning to experts for guidance.
By Carric Dooley WW VP of Foundstone Services, Intel Security, 1/26/2015
Comment5 comments  |  Read  |  Post a Comment
Adobe Fixes Second Flash Flaw Exploited By Angler
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Second 0-day fix addresses UAF vulnerability.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/26/2015
Comment1 Comment  |  Read  |  Post a Comment
Building A Cybersecurity Program: 3 Tips
Jason Sachowski, Senior Forensic Investigator, ScotiabankCommentary
Getting from “we need” to “we have” a cybersecurity program is an investment in time and resources that’s well worth the effort.
By Jason Sachowski Senior Forensic Investigator, Scotiabank, 1/26/2015
Comment6 comments  |  Read  |  Post a Comment
Growing Open Source Use Heightens Enterprise Security Risks
Jai Vijayan, Freelance writerNews
Companies often have little clue about the extent of third-party code in the enterprise or the risks it poses, security experts say
By Jai Vijayan Freelance writer, 1/23/2015
Comment10 comments  |  Read  |  Post a Comment
Why Russia Hacks
Mike Walls, Managing Director Security Operations & Analysis, EdgeWaveCommentary
Conventional wisdom holds that Russia hacks primarily for financial gain. But equally credible is the belief that the Russians engage in cyberwarfare to further their geopolitical ambitions.
By Mike Walls Managing Director Security Operations & Analysis, EdgeWave, 1/23/2015
Comment16 comments  |  Read  |  Post a Comment
Diverse White Hat Community Leads To Diverse Vuln Disclosures
Sara Peters, Senior Editor at Dark ReadingNews
Researchers at Penn State find that courting new bug hunters is just as important as rewarding seasoned ones.
By Sara Peters Senior Editor at Dark Reading, 1/22/2015
Comment6 comments  |  Read  |  Post a Comment
The Internet of Abused Things
Liviu Arsene, Senior E-threat Analyst, Bitdefender
We need to find ways to better secure the Internet of Things, or be prepared to face the consequences.
By Liviu Arsene Senior E-threat Analyst, Bitdefender, 1/22/2015
Comment0 comments  |  Read  |  Post a Comment
NSA Report: How To Defend Against Destructive Malware
Kelly Jackson Higgins, Executive Editor at Dark ReadingQuick Hits
In the wake of the Sony breach, spy agency's Information Assurance Directorate (IAD) arm provides best practices to mitigate damage of data annihilation attacks.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/22/2015
Comment3 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
IBM Research Announces Cloud Breakthrough For Protecting Personal Data
ZeroFOX Acquires Vulnr
Proofpoint Releases Enterprise Protection Suite 8.0, Advances Email Security Leadership
Virtru Announces General Availability of its Encrypted Email and Digital Privacy Service
Ed Survey Results: Insider Threats
Verizon Announces Security Enhancement for IoT Deployments
New Patent Eliminates Passwords
CYBERTECH SPONSORING “DATA PRIVACY DAY 2015: SECURING THE INTERNET OF THINGS” NATIONAL SEMINAR
More Products & Releases
PR Newswire
WiIl Millennials Be The Death Of Data Security?
Chris Rouland, Founder & CEO, Bastille,  1/27/2015
Gas Stations Urged To Secure Internet-Exposed Fuel Tank Devices
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/26/2015
NFL Mobile Sports App Contains Super Bowl-Sized Vulns
Ericka Chickowski, Contributing Writer, Dark Reading,  1/27/2015
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Takeaways from International Data Privacy Day: The Internet of Things
Event looks at the future of data use and how we can - and should - protect personal privacy. Read >>
Partner Perspectives
What's This?
How to Save Time and Protect Your Smart Home
New technology can help secure the digitized home, from tablets and laptops to smart appliances and thermostats. Read >>
Cartoon
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.
White Papers
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4632
Published: 2015-01-31
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 does not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certifica...

CVE-2014-7287
Published: 2015-01-31
The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.

CVE-2014-7288
Published: 2015-01-31
Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.

CVE-2014-8266
Published: 2015-01-31
Multiple cross-site scripting (XSS) vulnerabilities in the note-creation page in QPR Portal 2014.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body field.

CVE-2014-8267
Published: 2015-01-31
Cross-site scripting (XSS) vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter.

Best of the Web
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Flash Poll
Video
Slideshows
Twitter Feed