InfoSec Book Club: What's On Your Fall Reading List?
Home Depot Breach May Not Be Related To BlackPOS, Target
Privacy, Security & The Geography Of Data Protection
Dark Reading Radio: CISO James Christiansen Shares Experiences
Black Hat & DEF CON: 3 Lessons From A Newbie
News & Commentary
DR Radio: A Grown-Up Conversation About Passwords
Sara Peters, Senior Editor at Dark ReadingCommentary
Cormac Herley of Microsoft Research will challenge everything you think you know about password management.
By Sara Peters Senior Editor at Dark Reading, 9/16/2014
Comment0 comments  |  Read  |  Post a Comment
In Defense Of Passwords
Corey Nachreiner, Director, Security Strategy & Research, WatchGuard TechnologiesCommentary
Long live the password (as long as you use it correctly along with something else).
By Corey Nachreiner Director, Security Strategy & Research, WatchGuard Technologies, 9/16/2014
Comment0 comments  |  Read  |  Post a Comment
The Security Skills Shortage No One Talks About
Jeremy Bergsman & Emma Kinnucan, CEBCommentary
Lack of soft skills in information security is an even bigger problem than the shortage of technical expertise.
By Jeremy Bergsman & Emma Kinnucan CEB, 9/16/2014
Comment1 Comment  |  Read  |  Post a Comment
Worm Illuminates Potential NAS Nightmare
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
A researcher at Black Hat Europe hopes to demonstrate a homegrown, self-replicating worm to illustrate major threats to popular network-attached storage systems.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 9/15/2014
Comment2 comments  |  Read  |  Post a Comment
Internet Of Things Devices Are Doomed
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Security researchers hack Canon printer firmware to run the classic 90s video game Doom as well as to wreak havoc with other manipulations.
By Ericka Chickowski Contributing Writer, Dark Reading, 9/15/2014
Comment6 comments  |  Read  |  Post a Comment
5 Myths: Why We Are All Data Security Risks
Lance Cottrell, Chief Scientist, NtrepidCommentary
I am absolutely sure that I could be tricked by a well-crafted spear phishing attack, and I am equally sure I could do the same to you.
By Lance Cottrell Chief Scientist, Ntrepid, 9/15/2014
Comment5 comments  |  Read  |  Post a Comment
Security Ops Confidence Levels Drop
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Survey shows most organizations unable to keep up with new and emerging threats from state-sponsored attackers.
By Ericka Chickowski Contributing Writer, Dark Reading, 9/12/2014
Comment5 comments  |  Read  |  Post a Comment
Why Email Is Worth Saving
Daniel Ingevaldson, CTO, Easy SolutionsCommentary
What if an Internet-scale, federated policy, authentication, and enforcement framework for trusted email delivery were available? It is.
By Daniel Ingevaldson CTO, Easy Solutions, 9/12/2014
Comment11 comments  |  Read  |  Post a Comment
Veracode Secures $40M In Funding As IPO Looms
Brian Prince, Contributing Writer, Dark ReadingNews
Security firm plans to increase investments in sales, marketing, and research and development.
By Brian Prince Contributing Writer, Dark Reading, 9/12/2014
Comment1 Comment  |  Read  |  Post a Comment
Dyre Straits: Why This Cloud Attack's Different
Kaushik Narayan, Co-Founder and CTO at Skyhigh NetworksCommentary
Dyre is a new breed of Trojan, attacking cloud apps and using the cloud as a delivery vehicle.
By Kaushik Narayan Co-Founder and CTO at Skyhigh Networks, 9/12/2014
Comment3 comments  |  Read  |  Post a Comment
Franchising The Chinese APT
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
At least two different cyber espionage gangs in China appear to be employing uniform tools and techniques, FireEye finds.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 9/11/2014
Comment6 comments  |  Read  |  Post a Comment
Home Depot Breach May Not Be Related To BlackPOS, Target
Sara Peters, Senior Editor at Dark ReadingNews
New analysis of the malware earlier identified as a BlackPOS variant leads some researchers to believe that they are two different malware families entirely.
By Sara Peters Senior Editor at Dark Reading, 9/11/2014
Comment5 comments  |  Read  |  Post a Comment
Apple Pay: A Necessary Push To Transform Consumer Payments
Lucas Zaichkowsky, Enterprise Defense Architect, AccessDataCommentary
Apple Pay is a strategic move that will rival PayPal and other contenders in the mobile wallet marketplace. The big question is whether consumers and businesses are ready to ditch the plastic.
By Lucas Zaichkowsky Enterprise Defense Architect, AccessData, 9/11/2014
Comment16 comments  |  Read  |  Post a Comment
Privacy, Security & The Geography Of Data Protection
Malte Pollmann, CEO, UtimacoCommentary
Data generation is global, so why do different parts of the world react differently to the same threat of security breaches and backdoors?
By Malte Pollmann CEO, Utimaco, 9/11/2014
Comment6 comments  |  Read  |  Post a Comment
Startup Uncovers Flaws In Mobile Apps, Launches New Security Service
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
Wandera says only one of seven US employees is given any guidance on mobile security by the employer.
By Tim Wilson Editor in Chief, Dark Reading, 9/11/2014
Comment3 comments  |  Read  |  Post a Comment
Google: No Breach In Latest Online Dump Of Credentials
Kelly Jackson Higgins, Executive Editor at Dark ReadingQuick Hits
The online leak of some 5 million username and password combinations consisted of mostly stale or older credentials that don't actually work, Google says.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 9/11/2014
Comment2 comments  |  Read  |  Post a Comment
Apple Pay Ups Payment Security But PoS Threats Remain
Sara Peters, Senior Editor at Dark ReadingNews
Apple's new contactless payment tech will not stop point-of-sale breaches like Home Depot and UPS, but it could make those breaches less valuable to attackers.
By Sara Peters Senior Editor at Dark Reading, 9/10/2014
Comment20 comments  |  Read  |  Post a Comment
Security Growing Pangs Loom For 100K+ Sites With Newly Untrusted Certificates
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Mozilla revokes 1024-bit root certificates in bid to improve Firefox security and similar changes to come for Chrome as Google plans to dump SHA-1 certificates.
By Ericka Chickowski Contributing Writer, Dark Reading, 9/10/2014
Comment0 comments  |  Read  |  Post a Comment
Attack Steals Online Banking Credentials From SMBs
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
The "Peter Pan" phish employs Dridex malware, experts say.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 9/10/2014
Comment1 Comment  |  Read  |  Post a Comment
Apple iCloud Hack's Other Victim: Cloud Trust
Charles Babcock, Editor At Large, InformationWeek Commentary
Our flash poll finds users feel more vulnerable about cloud security in general. No wonder: Apple's opening statement of indignation now sounds a little hollow.
By Charles Babcock Editor At Large, InformationWeek , 9/10/2014
Comment2 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Security Insights
3 Places to Enable 2-Factor Authentication Now
3 Places to Enable 2-Factor Authentication Now
Two-factor authentication is a ubiquitous, mature technology. Whether or not you use it for your network, here are three external services for which you should immediately enable it.
Comment1 comments
Read | Post a Comment
More Sophos Security Insights
PR Newswire
Apple Pay Ups Payment Security But PoS Threats Remain
Sara Peters, Senior Editor at Dark Reading,  9/10/2014
Apple Pay: A Necessary Push To Transform Consumer Payments
Lucas Zaichkowsky, Enterprise Defense Architect, AccessData,  9/11/2014
Why Email Is Worth Saving
Daniel Ingevaldson, CTO, Easy Solutions,  9/12/2014
Register for Dark Reading Newsletters
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant
Cartoon
White Papers
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Flash Poll
Video
Slideshows
Twitter Feed