Vulnerabilities / Threats
5/1/2013
01:05 PM
Tim Wilson
Tim Wilson
Commentary
50%
50%

Dark Reading's Seven-Year Itch

After seven years of covering the security industry, Dark Reading is just getting started

Seven years ago today, Dark Reading made its first appearance on the Web. The publication, like the security industry itself, has changed a great deal since May 1, 2006 -- and yet, as with the industry, many core themes remain constant.

When we launched Dark Reading, our goal was to build a single website where security professionals could go to find all of the information they needed about new threats and methods for stopping them.

In those days, nobody was talking about the cloud or advanced persistent threats or bring your own device. One of the biggest breaches that year was at the Department of Veterans Affairs, where an employee brought work home on a laptop that was subsequently stolen. One of our most popular stories was a penetration test by blogger Steve Stasiukonis, who put a benign infection on a bunch of thumb drives and placed them all over a company headquarters site (almost all of them were plugged into company computers).

Over the years, businesses have been inundated with new attacks ranging from Stuxnet to Storm, from Anonymous to Zeus. And yet, those lost laptops and infected thumb drives continue to be a problem for most enterprises.

In 2006, we were writing about the features of antivirus and IPS products, noting their particular flaws and inability to prevent attacks from penetrating. The integrity of the security perimeter was at risk.

Since then, we've seen the launch of a wide range of technologies and strategies, from next-generation firewalls to data leak prevention to threat intelligence services. And yet, experts are still complaining about the failure of AV technology, and most have all but given up the idea of maintaining a secure perimeter.

Perhaps the lesson we're taught from the past seven years is that while attacks and technology change, the nature of security itself doesn't. We may be dealing with an unprecedented volume and sophistication of malware, but that doesn't change the fact that humans are at the heart of most of our defenses -- and most of our compromises. And security, like everything else that's human, is a work in progress.

For Dark Reading's part, our pledge is to continue to strive to be that single source of news and information that you need in your efforts as a security professional. We've taken some steps recently to improve our content, such as the redesign launched in April, and we have more plans in store for improving the usefulness and interactivity of the site. We have an itch to take this site to a new level, and we look forward to the days ahead.

And for those of you who have been reading us over these past seven years, thank you. We hope we'll continue to be one of your primary sites for security news and information for another seven years -- and beyond.

--Tim Wilson, Kelly Jackson Higgins, and the staff and contributors of Dark Reading Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jc
50%
50%
jc,
User Rank: Apprentice
5/2/2013 | 3:14:37 PM
re: Dark Reading's Seven-Year Itch
Happy Birthday Dark Reading!
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.