Operations
News & Commentary
Be Aware: 8 Tips for Security Awareness Training
Sara Peters, Senior Editor at Dark Reading
Hint: One giant security training session to rule them all is not the way to go.
By Sara Peters Senior Editor at Dark Reading, 9/29/2014
Comment7 comments  |  Read  |  Post a Comment
Can We Talk? Finding A Common Security Language
Jason Polancich, Founder & Chief Architect, SurfWatchLabsCommentary
How engineers can get beyond the crippling vocabulary and semantic barrier of infosec and actually communicate about cyber risk with bosses and business colleagues.
By Jason Polancich Founder & Chief Architect, SurfWatchLabs, 9/29/2014
Comment7 comments  |  Read  |  Post a Comment
How SaaS Adoption Is Changing Cloud Security
Tal Klein, VP Strategy, AdallomCommentary
Sanctioning cloud-based services requires a new approach to security that "assumes breach" and accounts for the limitations of endpoint and perimeter defenses.
By Tal Klein VP Strategy, Adallom, 9/25/2014
Comment6 comments  |  Read  |  Post a Comment
From Securities To Security: Why The SEC Is Bringing Cyber To The Boardroom
Stephen Boyer, CTO & Founder, BitSight TechnologiesCommentary
The SEC is emerging as a key proponent of corporate cyber security responsibility and diligence. What does that mean for the CISO?
By Stephen Boyer CTO & Founder, BitSight Technologies, 9/24/2014
Comment5 comments  |  Read  |  Post a Comment
Are Directories The On-Premises Sacred Cow?
Ericka Chickowski, Contributing Writer, Dark ReadingNews
As a server orchestration startup reengineers itself into a directory-as-a-service play, the question is why the market hasn't moved to say goodbye to Active Directory and LDAP.
By Ericka Chickowski Contributing Writer, Dark Reading, 9/23/2014
Comment0 comments  |  Read  |  Post a Comment
Creating A DDoS Response Playbook
Brian Prince, Contributing Writer, Dark ReadingNews
A new report details challenges posed by DDoS attacks that you might not have considered.
By Brian Prince Contributing Writer, Dark Reading, 9/23/2014
Comment1 Comment  |  Read  |  Post a Comment
Hacking Hackers: Taking Matters Into Private Hands
Becca Lipman, Senior EditorNews
Private groups are fighting back against foreign sources of malware and credit fraud. But methodologies put these digital crusaders and their employers at serious legal risk.
By Becca Lipman Senior Editor, 9/23/2014
Comment0 comments  |  Read  |  Post a Comment
Healthcare Needs Cyber Security Leadership & Governance
Mansur Hasib, Contributing WriterCommentary
Cyber security breaches point to a bigger problem than inadequate security technology or processes. They point to failed leadership and governance strategies.
By Mansur Hasib Contributing Writer, 9/23/2014
Comment4 comments  |  Read  |  Post a Comment
Mobile-Only Employee Trend Could Break Security Models
Ericka Chickowski, Contributing Writer, Dark ReadingNews
One-third of employees exclusively use mobile devices for work, but security organizations still aren't shifting their risk management focus.
By Ericka Chickowski Contributing Writer, Dark Reading, 9/22/2014
Comment10 comments  |  Read  |  Post a Comment
The Truth About Ransomware: Youíre On Your Own
Andrew Hay, Sr. Security Research Lead & Evangelist, OpenDNSCommentary
What should enterprises do when faced with ransomware? The answer is, it depends.
By Andrew Hay Sr. Security Research Lead & Evangelist, OpenDNS, 9/22/2014
Comment1 Comment  |  Read  |  Post a Comment
5 Top Tips For Outsourced Security
Lorna Garey, Content Director, InformationWeek Reports
It's one thing to hire a third-party developer to build a mobile app. It's quite another to trust a pen tester, MSSP, or DDoS protection firm. But the fact is, the threat landscape is complex, and few organizations can keep security completely in house. Here's how to decide what to outsource and select and manage providers.
By Lorna Garey Content Director, InformationWeek Reports, 9/22/2014
Comment5 comments  |  Read  |  Post a Comment
Is Enterprise IT Security Ready For iOS 8?
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Apple bakes in more security features, but iOS 8 won't come without security ops headaches.
By Ericka Chickowski Contributing Writer, Dark Reading, 9/19/2014
Comment4 comments  |  Read  |  Post a Comment
7 Reasons To Love Passwords
Sara Peters, Senior Editor at Dark Reading
Passwords are often ridiculed, but there are some reasons they should be your nearest and dearest authentication factor.
By Sara Peters Senior Editor at Dark Reading, 9/17/2014
Comment11 comments  |  Read  |  Post a Comment
Data Privacy Etiquette: It's Not Just For Kids
Lysa Myers, Security Researcher, ESETCommentary
Children are the innocent victims of the worst effects of social media. Thatís why itís vital for adults to establish privacy values that are safe for them -- and the rest of us.
By Lysa Myers Security Researcher, ESET, 9/17/2014
Comment10 comments  |  Read  |  Post a Comment
In Defense Of Passwords
Corey Nachreiner, Director, Security Strategy & Research, WatchGuard TechnologiesCommentary
Long live the password (as long as you use it correctly along with something else).
By Corey Nachreiner Director, Security Strategy & Research, WatchGuard Technologies, 9/16/2014
Comment12 comments  |  Read  |  Post a Comment
5 Myths: Why We Are All Data Security Risks
Lance Cottrell, Chief Scientist, NtrepidCommentary
I am absolutely sure that I could be tricked by a well-crafted spear phishing attack, and I am equally sure I could do the same to you.
By Lance Cottrell Chief Scientist, Ntrepid, 9/15/2014
Comment12 comments  |  Read  |  Post a Comment
Why Email Is Worth Saving
Daniel Ingevaldson, CTO, Easy SolutionsCommentary
What if an Internet-scale, federated policy, authentication, and enforcement framework for trusted email delivery were available? It is.
By Daniel Ingevaldson CTO, Easy Solutions, 9/12/2014
Comment11 comments  |  Read  |  Post a Comment
Apple Pay: A Necessary Push To Transform Consumer Payments
Lucas Zaichkowsky, Enterprise Defense Architect, AccessDataCommentary
Apple Pay is a strategic move that will rival PayPal and other contenders in the mobile wallet marketplace. The big question is whether consumers and businesses are ready to ditch the plastic.
By Lucas Zaichkowsky Enterprise Defense Architect, AccessData, 9/11/2014
Comment16 comments  |  Read  |  Post a Comment
Security Growing Pangs Loom For 100K+ Sites With Newly Untrusted Certificates
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Mozilla revokes 1024-bit root certificates in bid to improve Firefox security and similar changes to come for Chrome as Google plans to dump SHA-1 certificates.
By Ericka Chickowski Contributing Writer, Dark Reading, 9/10/2014
Comment0 comments  |  Read  |  Post a Comment
InfoSec Book Club: Whatís On Your Fall Reading List?
Marilyn Cohodas, Community Editor, Dark Reading
Dark Reading community members share the books that inform and inspire their decisions and interactions as security professionals.
By Marilyn Cohodas Community Editor, Dark Reading, 9/9/2014
Comment8 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Security Insights
3 Places to Enable 2-Factor Authentication Now
3 Places to Enable 2-Factor Authentication Now
Two-factor authentication is a ubiquitous, mature technology. Whether or not you use it for your network, here are three external services for which you should immediately enable it.
Comment1 comments
Read | Post a Comment
More Sophos Security Insights
PR Newswire
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, weíll take a close look at some of the latest research and practices in application security.