Vulnerabilities / Threats //

Insider Threats

News & Commentary
6 Ways to Tell an Insider Has Gone Rogue
Jai Vijayan, Freelance writer
Malicious activity by trusted users can be very hard to catch, so look for these red flags.
By Jai Vijayan Freelance writer, 7/19/2018
Comment0 comments  |  Read  |  Post a Comment
Time to Yank Cybercrime into the Light
Marc Wilczek, Digital Strategist & CIO AdvisorCommentary
Too many organizations are still operating blindfolded, research finds.
By Marc Wilczek Digital Strategist & CIO Advisor, 7/16/2018
Comment0 comments  |  Read  |  Post a Comment
Microsoft July Security Updates Mostly Browser-Related
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Patch Tuesday includes 53 security updates, including mitigation for the latest side-channel attack.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 7/10/2018
Comment0 comments  |  Read  |  Post a Comment
Reactive or Proactive? Making the Case for New Kill Chains
Ryan Stolte, co-founder and CTO at Bay DynamicsCommentary
Classic kill chain models that aim to find and stop external attacks don't account for threats from insiders. Here what a modern kill chain should include.
By Ryan Stolte co-founder and CTO at Bay Dynamics, 7/6/2018
Comment1 Comment  |  Read  |  Post a Comment
9 SMB Security Trends
Steve Zurier, Freelance Writer
SMBs understand they have to focus more on cybersecurity. Here's a look at the areas they say matter most.
By Steve Zurier Freelance Writer, 7/5/2018
Comment1 Comment  |  Read  |  Post a Comment
Today! 'Why Cybercriminals Attack,' A Dark Reading Virtual Event
Dark Reading Staff, Commentary
Wednesday, June 27, this all-day event starting at 11 a.m. ET, will help you decide who and what you really need to defend against, and how to do it more effectively.
By Dark Reading Staff , 6/27/2018
Comment3 comments  |  Read  |  Post a Comment
Insider Dangers Are Hiding in Collaboration Tools
Ericka Chickowski, Contributing Writer, Dark ReadingNews
The casual sharing of sensitive data, such as passwords, is opening the door to malicious insiders.
By Ericka Chickowski Contributing Writer, Dark Reading, 6/26/2018
Comment14 comments  |  Read  |  Post a Comment
12 Trends Shaping Identity Management
Sara Peters, Senior Editor at Dark Reading
As IAM companies try to stretch 'identity context' into all points of the cybersecurity market, identity is becoming 'its own solar system.'
By Sara Peters Senior Editor at Dark Reading, 4/26/2018
Comment1 Comment  |  Read  |  Post a Comment
Verizon DBIR: Ransomware Attacks Double for Second Year in a Row
Sara Peters, Senior Editor at Dark ReadingNews
Outside attackers still the biggest problem - except in healthcare.
By Sara Peters Senior Editor at Dark Reading, 4/10/2018
Comment0 comments  |  Read  |  Post a Comment
Privilege Abuse Attacks: 4 Common Scenarios
Michael Fimin, CEO & Co-Founder, NetwrixCommentary
It doesn't matter if the threat comes from a disgruntled ex-employee or an insider anticipating financial gain, privilege abuse patterns are pretty much the same, and they're easy to avoid.
By Michael Fimin CEO & Co-Founder, Netwrix, 3/7/2018
Comment1 Comment  |  Read  |  Post a Comment
CERT.org Goes Away, Panic Ensues
Dark Reading Staff, Quick Hits
Turns out the Carnegie Mellon CERT just moved to a newly revamped CMU Software Engineering Institute website.
By Dark Reading Staff , 3/5/2018
Comment0 comments  |  Read  |  Post a Comment
Why Cryptocurrencies Are Dangerous for Enterprises
David Shefter, Chief Technology Officer at Ziften TechnologiesCommentary
When employees mine coins with work computers, much can go wrong. But there are some ways to stay safe.
By David Shefter Chief Technology Officer at Ziften Technologies, 2/28/2018
Comment1 Comment  |  Read  |  Post a Comment
Leveraging Security to Enable Your Business
Jackson Shaw, VP of Product Management, One IdentityCommentary
When done right, security doesn't have to be the barrier to employee productivity that many have come to expect. Here's how.
By Jackson Shaw VP of Product Management, One Identity, 2/23/2018
Comment0 comments  |  Read  |  Post a Comment
Doh!!! The 10 Most Overlooked Security Tasks
Steve Zurier, Freelance Writer
Heres a list of gotchas that often slip past overburdened security pros.
By Steve Zurier Freelance Writer, 1/16/2018
Comment3 comments  |  Read  |  Post a Comment
NSA Employee Pleads Guilty to Illegally Retaining National Defense Secrets
Jai Vijayan, Freelance writerNews
Nghia Hoang Pho faces up to eight years in prison for removing highly classified NSA data from workplace and storing it at home.
By Jai Vijayan Freelance writer, 12/4/2017
Comment2 comments  |  Read  |  Post a Comment
How Law Firms Can Make Information Security a Higher Priority
Tom Cross, Chief Technology Officer of OPAQ NetworksCommentary
Lawyers always have been responsible for protecting their clients' information, but that was a lot easier to do when everything was on paper. Here are four best practices to follow.
By Tom Cross Chief Technology Officer of OPAQ Networks, 11/8/2017
Comment1 Comment  |  Read  |  Post a Comment
3 Steps to Reduce Risk in Your Supply Chain
Dan Dahlberg, Research Scientist at BitSightCommentary
Many companies have very limited visibility into their vendors' security posture -- and some may have thousands of vendors. Here are steps that every company should take to lock down their supply chains.
By Dan Dahlberg Research Scientist at BitSight, 10/27/2017
Comment1 Comment  |  Read  |  Post a Comment
Security Training & Awareness: 3 Big Myths
Eyal Benishti, CEO & Founder of IRONSCALESCommentary
The once-overwhelming consensus that security awareness programs are invaluable is increasingly up for debate.
By Eyal Benishti CEO & Founder of IRONSCALES, 10/23/2017
Comment6 comments  |  Read  |  Post a Comment
10 Social Engineering Attacks Your End Users Need to Know About
Steve Zurier, Freelance Writer
It's Cybersecurity Awareness Month. Make sure your users are briefed on these 10 attacker techniques that are often overlooked.
By Steve Zurier Freelance Writer, 10/19/2017
Comment0 comments  |  Read  |  Post a Comment
What's Next after the SEC 'Insider Trading' Breach?
David L. Axelrod and Terence M. Grugan, Partner, Ballard SpahrCommentary
Last month's hack of the Securities and Exchange Commission may prove to be the most high-profile corporate gatekeeper attack to date. But it definitely won't be the last.
By David L. Axelrod and Terence M. Grugan Partner, Ballard Spahr, 10/19/2017
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by Kolina
Current Conversations I have the same fillings about Google's work on this.. Great written
In reply to: ... HA!">Re: Google teaming with ... HA!
Post Your Own Reply
More Conversations
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Number of Retailers Impacted by Breaches Doubles
Ericka Chickowski, Contributing Writer, Dark Reading,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.