Perimeter
News & Commentary
Infographic: With BYOD, Mobile Is The New Desktop
Adam Ely, COO, BlueboxCommentary
Security teams have no choice but to embrace the rapid proliferation of BYO devices, apps, and cloud services. To ignore it is to put your head in the sand.
By Adam Ely COO, Bluebox, 7/22/2014
Comment0 comments  |  Read  |  Post a Comment
Internet of Things: Security For A World Of Ubiquitous Computing
Candace Worley, SVP & GM, Endpoint Security, McAfeeCommentary
Endpoint security is hardly dead, and claiming that it is oversimplifies the challenges corporations face now and in the not-very-distant future.
By Candace Worley SVP & GM, Endpoint Security, McAfee, 7/21/2014
Comment1 Comment  |  Read  |  Post a Comment
Why A Secured Network Is Like The Human Body
Dan Ross, CEO & President, PromisecCommentary
It’s time to throw away the analogies about building fortresses and perimeter defenses and start to approach InfoSec with the same standard of care we use for public health.
By Dan Ross CEO & President, Promisec, 6/26/2014
Comment11 comments  |  Read  |  Post a Comment
Content Widget Maker Taboola Is Hacked On Reuters
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
Syrian Electronic Army targets widget used by many publishers to surface content that the reader might like.
By Tim Wilson Editor in Chief, Dark Reading, 6/24/2014
Comment1 Comment  |  Read  |  Post a Comment
Experts: CrowdStrike China Hacker Report Raises Red Flags For Business
Tim Wilson, Editor in Chief, Dark ReadingNews
The second report on China’s hacking teams supports Department of Justice's accusations, offers insight on Chinese attackers.
By Tim Wilson Editor in Chief, Dark Reading, 6/11/2014
Comment1 Comment  |  Read  |  Post a Comment
If HTML5 Is The Future, What Happens To Access Control?
Garret Grajek, CTO & COO, SecureAuthCommentary
The solution for multi-device deployment is HTML5. The challenge, for the enterprise, is deploying it correctly. Here are seven tools you will need.
By Garret Grajek CTO & COO, SecureAuth, 6/5/2014
Comment1 Comment  |  Read  |  Post a Comment
How The Math Of Biometric Authentication Adds Up
Dave Kearns, Analyst, Kuppinger-ColeCommentary
Yes, it's true that if your authentication scheme only allows a single fingerprint you only have 10 choices. But there's no rule that says it has to be one, and only one.
By Dave Kearns Analyst, Kuppinger-Cole, 6/2/2014
Comment12 comments  |  Read  |  Post a Comment
SSL: Security's Best Friend Or Worst Enemy?
Ericka Chickowski, Contributing Writer, Dark ReadingNews
A new report shows that applications using SSL are on the rise in enterprises, putting them at greater risk of attacks that hide in plain sight or use vulnerabilities like Heartbleed.
By Ericka Chickowski Contributing Writer, Dark Reading, 6/2/2014
Comment0 comments  |  Read  |  Post a Comment
Tech Insight: Free Tools For Offensive Security
John H. Sawyer, Contributing Writer, Dark ReadingCommentary
A professional penetration tester offers a look at the latest free and open-source tools available for pen testing and offensive tactics.
By John H. Sawyer Contributing Writer, Dark Reading, 5/19/2014
Comment6 comments  |  Read  |  Post a Comment
Dispelling The Myths Of Cyber Security
Mark Goldstein & Arun Sood, Principal, SafeSecurePrivate / PhD, Founder & CEO, SCIT LabsCommentary
Perfect security that focuses on eliminating threats is too expensive and impossible to achieve. Better to think about consequence management.
By Mark Goldstein & Arun Sood Principal, SafeSecurePrivate / PhD, Founder & CEO, SCIT Labs, 5/14/2014
Comment3 comments  |  Read  |  Post a Comment
Report: Nearly 200 Million Records Compromised In Q1
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
More than 250 breaches were disclosed in Q1 2014, SafeNet report says.
By Tim Wilson Editor in Chief, Dark Reading, 5/1/2014
Comment4 comments  |  Read  |  Post a Comment
Report: Some Retail Firms Still Don't Recognize Cyber Security Risks
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
Nearly 10 percent of retail firms have not reported any cyber security exposure to the SEC since 2011, Willis Group says.
By Tim Wilson Editor in Chief, Dark Reading, 4/24/2014
Comment2 comments  |  Read  |  Post a Comment
How A Little Obscurity Can Bolster Security
Corey Nachreiner, Director, Security Strategy & Research, WatchGuard TechnologiesCommentary
Most security professionals deride the idea of "security by obscurity." Is it time to re-evaluate the conventional wisdom?
By Corey Nachreiner Director, Security Strategy & Research, WatchGuard Technologies, 4/17/2014
Comment21 comments  |  Read  |  Post a Comment
Mobility: Who Bears The Brunt Of Data Security & Privacy
Grayson Milbourne, Director, Security Intelligence, WebrootCommentary
OS manufacturers, app developers, and consumers all have a role to play in smartphone data security. But not everyone is equally responsible.
By Grayson Milbourne Director, Security Intelligence, Webroot, 4/16/2014
Comment3 comments  |  Read  |  Post a Comment
Nominum: 24 Million Home Routers Exposing ISPs to DDoS Attacks
Brian Prince, Contributing Writer, Dark ReadingNews
Even Internet service providers that go to great lengths to protect their networks are vulnerable.
By Brian Prince Contributing Writer, Dark Reading, 4/4/2014
Comment7 comments  |  Read  |  Post a Comment
MACH37 Funds Six New Security Startups
Tim Wilson, Editor in Chief, Dark ReadingQuick Hits
The cyberaccelerator MACH37 begins work with six emerging cybersecurity firms.
By Tim Wilson Editor in Chief, Dark Reading, 3/27/2014
Comment1 Comment  |  Read  |  Post a Comment
Is The Hypervisor Security's Goldilocks Zone?
Ericka Chickowski, Contributing Writer, Dark ReadingNews
RSA presentation to put virtualization forward as a tool to fix security's architectural problems
By Ericka Chickowski Contributing Writer, Dark Reading, 2/21/2014
Comment1 Comment  |  Read  |  Post a Comment
Is The Hypervisor Security's Goldilocks Zone?
Ericka Chickowski, Contributing Writer, Dark ReadingNews
RSA presentation to put virtualization forward as a tool to fix security's architectural problems
By Ericka Chickowski Contributing Writer, Dark Reading, 2/21/2014
Comment1 Comment  |  Read  |  Post a Comment
Target Compromised Via Its HVAC Contractor's Network Credentials
Brian Prince, Contributing Writer, Dark ReadingNews
Attackers compromised credentials for a third party and were off to the races -- leaving a key concept of network security in the dust
By Brian Prince Contributing Writer, Dark Reading, 2/7/2014
Comment4 comments  |  Read  |  Post a Comment
Target Compromised Via Its HVAC Contractor's Network Credentials
Brian Prince, Contributing Writer, Dark ReadingNews
Attackers compromised credentials for a third party and were off to the races -- leaving a key concept of network security in the dust
By Brian Prince Contributing Writer, Dark Reading, 2/7/2014
Comment4 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Security Insights
Back To Basics
Back To Basics
By failing to execute on basic security, we’re making the attacker's job too easy.
Comment2 comments
Read | Post a Comment
More Sophos Security Insights
PR Newswire
Register for Dark Reading Newsletters
White Papers
Current Issue
Cartoon
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

CVE-2014-4511
Published: 2014-07-22
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.

CVE-2014-4911
Published: 2014-07-22
The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.