Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

Most Commented Content posted in April 2014
Active Directory Is Dead: 3 Reasons
Commentary  |  4/15/2014  | 
These days, Active Directory smells gangrenous to innovative companies born in the cloud and connecting customers, employees, and partners across devices at light speed.
How A Little Obscurity Can Bolster Security
Commentary  |  4/17/2014  | 
Most security professionals deride the idea of "security by obscurity." Is it time to re-evaluate the conventional wisdom?
Whats Worse: Credit Card Or Identity Theft?
Commentary  |  4/9/2014  | 
When it comes to data loss, its time for the conversation to shift from credit cards to personal information like Social Security numbers, home addresses, and your favorite flavor of ice cream.
CIO Vs. CSO: Allies Or Enemies?
Commentary  |  4/14/2014  | 
In the wake of the Target breach it's clear that the CIO and CSO must have clear boundaries of responsibility and equal representation in the board room.
NSAs Big Surprise: Govt Agency Is Actually Doing Its Job
Commentary  |  4/4/2014  | 
When people claimed after 9/11 that the NSA was ill equipped to deal with a changing world, I wonder what they expected to happen.
Be Careful Beating Up Target
Commentary  |  4/1/2014  | 
Target was actually better prepared than most retailers. The real problem lies with the current state of industry threat intelligence and IR practices.
Workplace Data Privacy Vs. Security: The New Balance
Commentary  |  4/23/2014  | 
Is it time to rethink the traditional lock-down approach to employee use of corporate networks at work?
Mobile & Social: The Tipping Point For Cybercrime
Commentary  |  4/29/2014  | 
Spamming and scamming has moved to social media in full force, according to new research on the Twittersphere from Trend Micro.
Post-Heartbleed: When Not To Change Your Password
Commentary  |  4/30/2014  | 
One takeaway from Heartbleed is that conventional wisdom about the need to periodically change passwords is wrong.
The Right Stuff: Staffing Your Corporate SOC
Commentary  |  4/2/2014  | 
What makes a top-notch security analyst? Passion, experience, and communication skills trump certifications and degrees. But you get what you pay for.
The Real Wakeup Call From Heartbleed
Commentary  |  4/16/2014  | 
There's nothing special about Heartbleed. Its another flaw in a popular library that exposed a lot of servers to attack. The danger lies in the way software libraries are built and whether they can be trusted.
Tech Insight: Making Data Classification Work
Commentary  |  4/4/2014  | 
Data classification involves much more than simply buying a product and dropping it in place. Here are some dos and don'ts.
FAQ: Understanding The True Price of Encryption
Commentary  |  4/21/2014  | 
In the wake of recent events like Heartbleed, the search for cost-effective, easy, and scalable encryption solutions has never been more important.
Why Bug Bounties Are The New Normal
Commentary  |  4/28/2014  | 
Bug bounties today are big business. Find out how crowdsourcing is changing the dynamics of independent security research and vulnerability disclosure.
'Baby Teeth' In Infrastructure Cyber Security Framework
Commentary  |  4/14/2014  | 
NISTs modest effort to improve lax security around IT infrastructure in airports, utilities, and other critical areas now heads to Congress. Don't hold your breath.
Heartbleed: Examining The Impact
Commentary  |  4/10/2014  | 
With Heartbleed, theres little hope of knowing if an asset was breached, if a breach can be identified, or what, if any, data was leaked. Heres how to defend against future attacks.
API-First: 3 Steps For Building Secure Cloud Apps
Commentary  |  4/3/2014  | 
When it comes to protecting data traveling to and from the cloud, today's choices are daunting. Here are three steps for making the application programming interface your new best friend.
Data Security: Think Outside The Box
Commentary  |  4/25/2014  | 
What the public and private sector can learn from each other's data security priorities is an exercise in nuance that is well worth the effort. Here's why.
7 Tips To Improve 'Signal-to-Noise' In The SOC
Commentary  |  4/22/2014  | 
When security analysts are desensitized to alerts because of sheer volume, they miss the true positives that can prevent a large-scale data breach. Here's how to up your game.
Mobility: Who Bears The Brunt Of Data Security & Privacy
Commentary  |  4/16/2014  | 
OS manufacturers, app developers, and consumers all have a role to play in smartphone data security. But not everyone is equally responsible.
Poll: Dark Reading Community Acts On Heartbleed
Commentary  |  4/18/2014  | 
Roughly 60 percent of respondents to our flash poll have installed the Heartbeat fix or are in the process of doing so.
One Year Later: The APT1 Report
Commentary  |  4/8/2014  | 
One of the most positive impacts of APT1 is the undeniable rise in the stature of the threat intelligence industry. "Threat Intelligence" is the SIEM, the NAC of 2014.
Extra, Extra: What's New With Dark Reading News & Analysis
Commentary  |  4/2/2014  | 
How to share your opinion, news tips, and ideas.
If Mother Nature Were A CISO
Commentary  |  4/7/2014  | 
There are many defensive patterns in nature that also apply to information security. Here's how to defeat your predators in the high-stakes game of corporate survival and resiliency.
How To Detect Heartbleed Mutations
Commentary  |  4/24/2014  | 
The nightmare of Heartbleed is not the chaos of fixing the bug. It's identifying hundreds, possibly thousands, of small mutations still hiding in the network.
We Are the Perimeter
Guest Blogs  |  4/7/2014  | 
End users, not technology, define the boundaries of the enterprise. Security strategies must protect this new perimeter.
Flash Poll: Broken Heartbeat
Commentary  |  4/10/2014  | 
What steps do you plan to take in response to the Heartbleed bug? Take our poll and share your reasons in the comments.


News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3633
PUBLISHED: 2021-02-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2021-20203
PUBLISHED: 2021-02-25
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS s...
CVE-2021-3406
PUBLISHED: 2021-02-25
A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.
CVE-2021-20327
PUBLISHED: 2021-02-25
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node....
CVE-2021-20328
PUBLISHED: 2021-02-25
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in inte...