Database Security
Authentication
Privacy
Compliance
Careers & People
Identity & Access Management
Threat Intelligence
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Risk
News & Commentary
Building A Cybersecurity Program: 3 Tips
Jason Sachowski, Senior Forensic Investigator, ScotiabankCommentary
Getting from “we need” to “we have” a cybersecurity program is an investment in time and resources that’s well worth the effort.
By Jason Sachowski Senior Forensic Investigator, Scotiabank, 1/26/2015
Comment3 comments  |  Read  |  Post a Comment
Why Russia Hacks
Mike Walls, Managing Director Security Operations & Analysis, EdgeWaveCommentary
Conventional wisdom holds that Russia hacks primarily for financial gain. But equally credible is the belief that the Russians engage in cyberwarfare to further their geopolitical ambitions.
By Mike Walls Managing Director Security Operations & Analysis, EdgeWave, 1/23/2015
Comment16 comments  |  Read  |  Post a Comment
What Government Can (And Can’t) Do About Cybersecurity
Jeff Williams, CTO, Aspect Security & Contrast SecurityCommentary
In his 2015 State of the Union address, President Obama introduced a number of interesting, if not terribly novel, proposals. Here are six that will have minimal impact.
By Jeff Williams CTO, Aspect Security & Contrast Security, 1/22/2015
Comment17 comments  |  Read  |  Post a Comment
President's Plan To Crack Down On Hacking Could Hurt Good Hackers
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Security experts critical of President Obama's new proposed cybersecurity legislation.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/21/2015
Comment9 comments  |  Read  |  Post a Comment
Facebook Messenger: Classically Bad AppSec
Daniel Riedel, CEO, New ContextCommentary
Facebook offers a textbook example of what the software industry needs to do to put application security in the forefront of software development.
By Daniel Riedel CEO, New Context, 1/21/2015
Comment2 comments  |  Read  |  Post a Comment
Ransomware Leads Surge In 2014 Mobile Malware Onslaught
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Mobile malware increases 75 percent in U.S.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/20/2015
Comment3 comments  |  Read  |  Post a Comment
The Truth About Malvertising
Peter Zavlaris, Analyst, RiskIQCommentary
Malvertising accounts for huge amounts of cyberfraud and identity theft. Yet there is still no consensus on who is responsible for addressing these threats.
By Peter Zavlaris Analyst, RiskIQ, 1/16/2015
Comment7 comments  |  Read  |  Post a Comment
Why North Korea Hacks
Mike Walls, Managing Director Security Operations & Analysis, EdgeWaveCommentary
The motivation behind Democratic People’s Republic of Korea hacking is rooted in a mix of retribution, paranoia, and the immature behavior of an erratic leader.
By Mike Walls Managing Director Security Operations & Analysis, EdgeWave, 1/15/2015
Comment10 comments  |  Read  |  Post a Comment
Insider Threats in the Cloud: 6 Harrowing Tales
Kaushik Narayan, Co-Founder and CTO at Skyhigh NetworksCommentary
The cloud has vastly expanded the scope of rogue insiders. Read on to discover the latest threat actors and scenarios.
By Kaushik Narayan Co-Founder and CTO at Skyhigh Networks, 1/13/2015
Comment5 comments  |  Read  |  Post a Comment
Obama Calls For 30-Day Breach Notification Policy For Hacked Companies
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
But chances of this becoming a mandatory national breach notification law are no sure thing, even in the wake of the past year's high-profile hacks, experts say.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/12/2015
Comment12 comments  |  Read  |  Post a Comment
Cloud Services Adoption: Rates, Reasons & Security Fears
Dave Kearns, Analyst, Kuppinger-ColeCommentary
Concern over data breaches and privacy are two reasons enterprises in the European Union didn’t increase their use of cloud services in 2014, according to the EU’s recent Eurostat report.
By Dave Kearns Analyst, Kuppinger-Cole, 1/12/2015
Comment3 comments  |  Read  |  Post a Comment
Chick-fil-A Breach: Avoiding 5 Common Security Mistakes
Kevin Watson, CEO, VendorSafeCommentary
On the surface these suggestions may seem simplistic. But almost every major retail breach in the last 12 months failed to incorporate at least one of them.
By Kevin Watson CEO, VendorSafe, 1/9/2015
Comment3 comments  |  Read  |  Post a Comment
Nation-State Cyberthreats: Why They Hack
Mike Walls, Managing Director Security Operations & Analysis, EdgeWaveCommentary
All nations are not created equal and, like individual hackers, each has a different motivation and capability.
By Mike Walls Managing Director Security Operations & Analysis, EdgeWave, 1/8/2015
Comment10 comments  |  Read  |  Post a Comment
It’s Time to Treat Your Cyber Strategy Like a Business
Jason Polancich, Founder & Chief Architect, SurfWatchLabsCommentary
How do we win against cybercrime? Take a cue from renowned former GE chief exec Jack Welch and start with a clearly-defined mission.
By Jason Polancich Founder & Chief Architect, SurfWatchLabs, 1/7/2015
Comment6 comments  |  Read  |  Post a Comment
Deconstructing The Sony Hack: What I Know From Inside The Military
Jeff Schilling, CSO, FirehostCommentary
Don't get caught up in the guessing game on attribution. The critical task is to understand the threat data and threat actor tactics to ensure you are not vulnerable to the same attack.
By Jeff Schilling CSO, Firehost, 1/6/2015
Comment15 comments  |  Read  |  Post a Comment
Dear Cyber Criminals: We’re Not Letting Our Guard Down in 2015
Sergio Galindo, GM, GFI SoftwareCommentary
Next year, you’ll keep exploiting vulnerabilities, and we’ll make sure our systems are patched, our antivirus is up to date, and our people are too smart to click the links you send them.
By Sergio Galindo GM, GFI Software, 12/31/2014
Comment5 comments  |  Read  |  Post a Comment
20 Startups To Watch In 2015
Ericka Chickowski, Contributing Writer, Dark Reading
Check our list of security startups sure to start (or continue) making waves in the coming year.
By Ericka Chickowski Contributing Writer, Dark Reading, 12/29/2014
Comment6 comments  |  Read  |  Post a Comment
A 2014 Lookback: Predictions vs. Reality
TK Keanini, CTO, LancopeCommentary
It was a tumultuous year for cyber security, but it drove the adoption of incident response plans and two-factor authentication.
By TK Keanini CTO, Lancope, 12/29/2014
Comment5 comments  |  Read  |  Post a Comment
Sony Fallout: The Terrorists Win Our Networks
Patrick Hubbard, Head Geek & Senior Technical Product Marketing Manager, SolarWindsCommentary
It's time to get serious. Sony hack may mark the end of enterprise networks as we know them.
By Patrick Hubbard Head Geek & Senior Technical Product Marketing Manager, SolarWinds, 12/29/2014
Comment25 comments  |  Read  |  Post a Comment
Why Digital Forensics In Incident Response Matters More Now
Craig Carpenter, President & COO, Resolution1 SecurityCommentary
By understanding what happened, when, how, and why, security teams can prevent similar breaches from occurring in the future.
By Craig Carpenter President & COO, Resolution1 Security, 12/24/2014
Comment6 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
RiskIQ Finds More Than 11 Percent of Android Banking and Finance- Related Apps are Suspicious
Waverley Labs and the Energy Production Infrastructure Center at UNC Charlotte Successfully Quantify Digital Risks for Power Grids
WatchGuard Uncovers Guest Network Security Lapses
Esentire Releases Cybersecurity Documentation Framework Featuring Infosec Policy, Incident Response Guidance
Entrust Datacard Adds Website Security Capabilities For SSL
NCC Group to Open Trust Domain For Registration
Merchant Financial Cyber Partnership Announces Next Steps for Securing the Payments System
37 Percent of Holiday Transactions Made from Mobile Devices
More Products & Releases
PR Newswire
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8148
Published: 2015-01-26
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

CVE-2014-8157
Published: 2015-01-26
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVE-2014-8158
Published: 2015-01-26
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVE-2014-9571
Published: 2015-01-26
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

CVE-2014-9572
Published: 2015-01-26
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.