Operations
News & Commentary
Hacking Back: Two Wrongs Donít Make A Right
Anthony Di Bello, Director, Security Practice, Guidance SoftwareCommentary
Hereís the critical issue: Do you want to risk engaging your company in an ego-fueled war of revenge, or do you want to cut the bad guys off at the pass?
By Anthony Di Bello Director, Security Practice, Guidance Software, 3/30/2015
Comment0 comments  |  Read  |  Post a Comment
Cyber Hunting: 5 Tips To Bag Your Prey
David J. Bianco, Security Architect, SqrrlCommentary
Knowing the lay of the land and where attackers hide is a key element in hunting, both in nature and in the cyber realm.
By David J. Bianco Security Architect, Sqrrl, 3/26/2015
Comment5 comments  |  Read  |  Post a Comment
FBI Threat Intelligence Cyber-Analysts Still Marginalized In Agency
Sara Peters, Senior Editor at Dark ReadingNews
Despite good progress, 9/11 Review Commission says that analysts could have a greater impact on FBI counter-terrorism activities if they had more domain awareness, forensics capabilities, and were more empowered to question agents.
By Sara Peters Senior Editor at Dark Reading, 3/25/2015
Comment1 Comment  |  Read  |  Post a Comment
The Internet Of Bring-Your-Own Things
David Lindner, Global Practice Manager, Mobile Application Security Services, Aspect SecurityCommentary
Devices and interconnected systems are finding a foothold not only in our homes but in mainstream organizations. Here are three tips to mitigate the risk.
By David Lindner Global Practice Manager, Mobile Application Security Services, Aspect Security, 3/25/2015
Comment1 Comment  |  Read  |  Post a Comment
Educating The Cyberwarriors Of The Future
Jeff Schilling, CSO, FirehostCommentary
If I have to choose between hiring a university-educated CompSci grad or an IT specialist strong in sysadmin, networking or programming, I will pick the IT specialist every time.
By Jeff Schilling CSO, Firehost, 3/24/2015
Comment8 comments  |  Read  |  Post a Comment
Worst Sports-Related Passwords
Sara Peters, Senior Editor at Dark ReadingNews
March Madness and Spring Training underway. NFL draft and NBA playoffs soon to come. Your users may be even more tempted than ever to create some of these bad sports-related passwords
By Sara Peters Senior Editor at Dark Reading, 3/23/2015
Comment18 comments  |  Read  |  Post a Comment
Context: Finding The Story Inside Your Security Operations Program
Joshua Goldfarb, VP & CTO - Americas, FireEye.Commentary
Whatís missing in todayís chaotic, alert-driven incident response queue is the idea of a narrative that provides a detailed understanding of how an attack actually unfolds.
By Joshua Goldfarb VP & CTO - Americas, FireEye., 3/23/2015
Comment6 comments  |  Read  |  Post a Comment
The Clinton Email Kerfuffle & Shadow IT
Ojas Rege, VP Strategy, MobileIronCommentary
For security pros the issue is not government transparency. It's the fact that users, regardless of seniority, will always pick convenience over security.
By Ojas Rege VP Strategy, MobileIron, 3/20/2015
Comment8 comments  |  Read  |  Post a Comment
Frenemies Of The C-Suite: CSO, CIO, CRO, CPO
Sara Peters, Senior Editor at Dark ReadingNews
Sometimes the security, IT, risk, and privacy offices just can't get along.
By Sara Peters Senior Editor at Dark Reading, 3/19/2015
Comment2 comments  |  Read  |  Post a Comment
New Security Mindset: Focus On The Interior
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Chief privacy officer Jason Straight shares his insights on why organizations are struggling to stop the breach wave -- and manage the aftermath.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 3/18/2015
Comment7 comments  |  Read  |  Post a Comment
The 7 Best Social Engineering Attacks Ever
Sara Peters, Senior Editor at Dark Reading
Seven reminders of why technology alone isn't enough to keep you secure.
By Sara Peters Senior Editor at Dark Reading, 3/17/2015
Comment4 comments  |  Read  |  Post a Comment
BlackBerry Looks To Revive Relevance By Doubling Down On Security
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Company launches new uber-secure tablet built on Samsung hardware, teams with IBM.
By Ericka Chickowski Contributing Writer, Dark Reading, 3/17/2015
Comment1 Comment  |  Read  |  Post a Comment
Dark Reading Radio: Security Pros At Risk Of Being Criminalized
Kelly Jackson Higgins, Executive Editor at Dark ReadingCommentary
ICYMI: Check out Dark Reading Radio's recent broadcast and discussion about the pitfalls of new government efforts to fight bad hackers that could ultimately hurt the good guys.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 3/16/2015
Comment3 comments  |  Read  |  Post a Comment
7 Deadly Sins Of Security Policy Change Management
Nimmy Reichenberg, VP of Strategy, AlgoSecCommentary
Mitigating these deadly sins requires process, visibility and automation. Itís an effort that will improve security and increase business agility.
By Nimmy Reichenberg VP of Strategy, AlgoSec, 3/16/2015
Comment1 Comment  |  Read  |  Post a Comment
Has Security Ops Outlived Its Purpose?
Tal Klein, VP Strategy, AdallomCommentary
CISOs will need more than higher headcounts and better automation tools to solve today's security problems.
By Tal Klein VP Strategy, Adallom, 3/13/2015
Comment15 comments  |  Read  |  Post a Comment
7 In 10 Businesses Struggle To Sustain PCI Compliance
Jai Vijayan, Freelance writerNews
Maintaining PCI compliance is a bigger challenge that achieving it for many companies, Verizon study finds.
By Jai Vijayan Freelance writer, 3/12/2015
Comment1 Comment  |  Read  |  Post a Comment
6 Ways The Sony Hack Changes Everything
John B. Dickson, CISSP,  Principal, Denim GroupCommentary
Security in a post-Sony world means that a company's very survival in the wake of a cyber attack is more of a concern than ever before.
By John B. Dickson CISSP, Principal, Denim Group, 3/11/2015
Comment5 comments  |  Read  |  Post a Comment
5 Things CISOs Can Learn From The Best GMs In Baseball
Kevin West, CEO & founder, K logixCommentary
A MLB team has many goals and objectives: to win, be profitable, have a solid strategy and understand the people whom they serve. Sound familiar?
By Kevin West CEO & founder, K logix, 3/10/2015
Comment2 comments  |  Read  |  Post a Comment
Second Look: Data Security In A Hybrid Cloud
Bill Kleyman, Director of Strategy & Innovation, MTM TechnologiesCommentary
Todayís big cloud providers were built around an architecture for hosting and securing data. They will continue to thrive, only by keeping your workloads safe.
By Bill Kleyman Director of Strategy & Innovation, MTM Technologies, 3/9/2015
Comment12 comments  |  Read  |  Post a Comment
Which Apps Should You Secure First? Wrong Question.
Jeff Williams, CTO, Aspect Security & Contrast SecurityCommentary
Instead, develop security instrumentation capability and stop wasting time on '4 terrible tactics' that focus on the trivial.
By Jeff Williams CTO, Aspect Security & Contrast Security, 3/5/2015
Comment1 Comment  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by mithoon
Current Conversations great post
In reply to: Re: name required
Post Your Own Reply
Posted by Marilyn Cohodas
Current Conversations Great point. Touche'
In reply to: Re: Data science
Post Your Own Reply
More Conversations
PR Newswire
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.