Risk
News & Commentary
OCR Audits: Don’t Fall Victim To Past Mistakes
Mark Fulford, Partner at LBMC’s Security & Risk ServicesCommentary
The Office of Civil Rights is not out to get you. But it does expect you to make good-faith efforts at protecting patient data.
By Mark Fulford Partner at LBMC’s Security & Risk Services, 11/21/2014
Comment0 comments  |  Read  |  Post a Comment
New Citadel Attack Targets Password Managers
Jai Vijayan, Freelance writerNews
IBM researchers have found signs that the prolific data steal Trojan is now being used to attack widely used password managers.
By Jai Vijayan Freelance writer, 11/20/2014
Comment1 Comment  |  Read  |  Post a Comment
Enter The Digital Risk Officer
Nick Sanna, President, Digital Risk Management InstituteCommentary
In the brave new world of digital risk management, a CISO would report up to a DRO who manages risk from a business perspective and works with peers in business ops, compliance, and IT security.
By Nick Sanna President, Digital Risk Management Institute, 11/20/2014
Comment1 Comment  |  Read  |  Post a Comment
The Rise Of The Resilient Mobile Botnet
Ericka Chickowski, Contributing Writer, Dark ReadingNews
New report on what researchers call one of the 'most sophisticated mobile botnets online' shows how profitable mobile malware has become.
By Ericka Chickowski Contributing Writer, Dark Reading, 11/19/2014
Comment0 comments  |  Read  |  Post a Comment
Is Rogue IT Really A Problem?
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Rogue IT may be a misnomer for the subtleties of IT security's involvement in cloud procurement.
By Ericka Chickowski Contributing Writer, Dark Reading, 11/17/2014
Comment1 Comment  |  Read  |  Post a Comment
Retail Hacking: What To Expect This Holiday Season
Kelly Jackson Higgins, Executive Editor at Dark ReadingCommentary
The next Dark Reading Radio episode on Nov. 19 at 1PM ET (10AM PT) features retail security experts from Mandiant and the retail industry.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 11/13/2014
Comment4 comments  |  Read  |  Post a Comment
New Attack Method Can Hit 95% Of iOS Devices
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Masque Attack replaces legit apps with malware using the same bundle identifier names.
By Ericka Chickowski Contributing Writer, Dark Reading, 11/10/2014
Comment7 comments  |  Read  |  Post a Comment
The Staggering Complexity of Application Security
Jeff Williams, CTO, Aspect Security & Contrast SecurityCommentary
During the past few decades of high-speed coding we have automated our businesses so fast that we are now incapable of securing what we have built.
By Jeff Williams CTO, Aspect Security & Contrast Security, 11/10/2014
Comment6 comments  |  Read  |  Post a Comment
3 IT Practices That Add Risk To Cloud
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Poor governance, sloppy data handling, and IAM missteps all increase cloud risk.
By Ericka Chickowski Contributing Writer, Dark Reading, 11/7/2014
Comment2 comments  |  Read  |  Post a Comment
Breach Fatigue Sets In With Consumers
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Report from Ponemon and RSA shows that consumers aren't really adjusting behavior due to mega breaches.
By Ericka Chickowski Contributing Writer, Dark Reading, 11/4/2014
Comment3 comments  |  Read  |  Post a Comment
Marrying Monitoring With IAM
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Prevalence of stolen online credentials and rampant password reuse means enterprises must keep better tabs on how credentials are used.
By Ericka Chickowski Contributing Writer, Dark Reading, 11/4/2014
Comment1 Comment  |  Read  |  Post a Comment
Preparing For A Data Breach: Think ‘Stop, Drop & Roll’
Phil Smith, SVP Security Solutions, TrustwaveCommentary
Breaches are going to happen, which is why we need to treat incident response readiness like fire drills, practicing time and time again until the response is practically instinctive.
By Phil Smith SVP Security Solutions, Trustwave, 11/3/2014
Comment0 comments  |  Read  |  Post a Comment
Cyberspace Expands Threat Matrix
Patience Wait, News
National security experts warn there is no privacy or security any more.
By Patience Wait , 11/3/2014
Comment1 Comment  |  Read  |  Post a Comment
Financial Breaches Show ‘Trust Model’ Is Broken
Bob West, Chief Trust Officer, CipherCloudCommentary
It’s a full-blown crisis when a dozen major financial services firms admit to having their networks probed by the same attackers as those behind the JPMorgan Chase breach.
By Bob West Chief Trust Officer, CipherCloud, 10/31/2014
Comment7 comments  |  Read  |  Post a Comment
Infographic: The Many Faces of Today’s Hackers
John Trobough, CEO, NarusCommentary
How many of these hacker personas are you dueling with in your organization?
By John Trobough CEO, Narus, 10/29/2014
Comment12 comments  |  Read  |  Post a Comment
Cyber Espionage Attacks Attributed To Russian Government
Ericka Chickowski, Contributing Writer, Dark ReadingNews
FireEye report meticulously details clues that all point to state-sponsorship of the Sofacy/Sourface malware and tracks its evolution over seven years.
By Ericka Chickowski Contributing Writer, Dark Reading, 10/29/2014
Comment0 comments  |  Read  |  Post a Comment
What Scares Me About Healthcare & Electric Power Security
John B. Dickson, CISSP,  Principal, Denim GroupCommentary
Both industries share many of the same issues as enterprises. But they also have a risk profile that makes them singularly unprepared for sophisticated threats
By John B. Dickson CISSP, Principal, Denim Group, 10/28/2014
Comment16 comments  |  Read  |  Post a Comment
Chipmaker Disables Counterfeits With Software Update
Jai Vijayan, Freelance writerNews
FTDI's update, targeting counterfeit chips, could disable systems widely embedded in healthcare, critical infrastructure, and consumer products.
By Jai Vijayan Freelance writer, 10/28/2014
Comment3 comments  |  Read  |  Post a Comment
A Simple Formula For Usable Risk Intelligence
Jason Polancich, Founder & Chief Architect, SurfWatchLabsCommentary
How infosec can cut through the noise and gain real value from cyberdata.
By Jason Polancich Founder & Chief Architect, SurfWatchLabs, 10/27/2014
Comment8 comments  |  Read  |  Post a Comment
Poll: Patching Is Primary Response to Shellshock
Marilyn Cohodas, Community Editor, Dark ReadingCommentary
As potential threats mount, Dark Reading community members home in on patching infrastructure but not devices, according to our latest poll.
By Marilyn Cohodas Community Editor, Dark Reading, 10/24/2014
Comment11 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2382
Published: 2014-11-20
The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of service (crash) and execute arbitrary code via a crafted IOCTL request that writes to arbitrary memory locations, related to the IofCallDriver function.

CVE-2014-3625
Published: 2014-11-20
Directory traversal vulnerability in Pivitol Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CVE-2014-7194
Published: 2014-11-20
TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vault before 1.1.1 allow remote attackers to obtain sensitive information or modify data by leveraging agent access.

CVE-2014-7195
Published: 2014-11-20
Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment Kit 6.0.x before 6.0.2 and 6.5.x before 6.5.2, and Silver Fabric Enabler for Spotfire Web Player before 1.6.1 allows remote authenticated users to obtain sensitive information via u...

CVE-2014-8000
Published: 2014-11-20
Cisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?