Operations

6/21/2018
02:40 PM
100%
0%

7 Places Where Privacy and Security Collide

Privacy and security can experience tension at a number of points in the enterprise. Here are seven - plus some possibilities for easing the strain.
Previous
1 of 8
Next

(Image: Joyseulay)

(Image: Joyseulay)

In a recent interview with Dark Reading, Cisco chief privacy officer Michelle Dennedy said that privacy was all about the contents of the metaphorical data pipe, while security concerned itself with the architecture of the pipe. For IT security professionals, issues arise when protecting the contents of the pipe, and the pipe itself, create tensions in how security operates.

There are a number of points at which these tensions arise in the "privacy versus security" dance. One of the most visible twirls around it is the topic of encryption, which can be used to both protect the privacy of individuals and shield the true nature of malware.

But that's not the only place where the needs of privacy and security can collide. Here, we take a look at seven — and want to know about others you have encountered. At which points have you seen privacy and security considerations collide? Let us know in the comments, below.

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
6/22/2018 | 6:10:49 PM
security vs. privacy, or security vs. security?
Encryption vs. visibility is not just a security vs. privacy issue; it's also a security vs. security issue as enterprise IT organizations find that they have to contend with the bad guys encrypting their own malicious traffic. At that point, how do you know what to attempt to decrypt, what to let through, what to guard against?

Cases in point: securitynow.com/author.asp?section_id=706&doc_id=743513&
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The State of IT and Cybersecurity
The State of IT and Cybersecurity
IT and security are often viewed as different disciplines - and different departments. Find out what our survey data revealed, read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.