Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

Content posted in October 2011
Basic Baselining For Quick Situational Awareness
Commentary  |  10/28/2011  | 
Baselines can be extremely valuable in knowing what's going on within your network, but they can't help if they're not created -- start with the basics
UBS Finds Risk Management Stress Test Costly
Commentary  |  10/25/2011  | 
UBS failed to stop a single rogue trader from racking up $2 billion in losses. Yet, some experts argue that banks overall may be better than others at managing risk.
Sinkholing For Profit
Commentary  |  10/24/2011  | 
Concerns over the legality and ethics of security organizations that profit from their sinkhole operations
Does Cybercrime Pay?
Commentary  |  10/21/2011  | 
Turning a profit in today's underground economy remains tough. Here's why.
Authentication Reality Check
Commentary  |  10/18/2011  | 
Two-factor authentication products slow to catch on
On Trusting Certificate Authorities
Commentary  |  10/18/2011  | 
The time has come for a way to vet CAs by reputation
Authentication With Hardware
Commentary  |  10/18/2011  | 
Needed: a unified way for users to log in websites regardless of the device they are using
FFIEC Goes Beyond Traditional Authentication
Commentary  |  10/18/2011  | 
The FFIEC recommends that organizations provide additional business and fraud detection controls to offset weaknesses in authentication technology
Pro Pen Testing: The Zero-Knowledge Approach
Commentary  |  10/14/2011  | 
Special care must be taken in a penetration test that locates targets with 'zero-knowledge'
McAfee + NitroSecurity: SIEM Merger Done Right
Commentary  |  10/12/2011  | 
McAfee showcases the perfect security company merger by bringing out a SIEM offering that better anticipates an increasingly hostile world
Advanced Threats And Scenario-Based Penetration Testing
Commentary  |  10/12/2011  | 
Why your pen-test efforts probably aren't preparing you for the worst
DerbyCon Fosters Community -- Videos Available Online
Commentary  |  10/7/2011  | 
DerbyCon's successful first year reminds us of what the security community is all about: sharing and learning from others, promoting new ideas, and advancing the art of security
Steve Jobs And Tech Security
Commentary  |  10/6/2011  | 
Apple's products continue to highlight what relatively secure operating system environments look like.
Most Consumers Don't Lock Mobile Phone Via PIN
Commentary  |  10/4/2011  | 
44% of respondents say its's too much of a hassle, new survey reports.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Incorporating a Prevention Mindset into Threat Detection and Response
Threat detection and response systems, by definition, are reactive because they have to wait for damage to be done before finding the attack. With a prevention-mindset, security teams can proactively anticipate the attacker's next move, rather than reacting to specific threats or trying to detect the latest techniques in real-time. The report covers areas enterprises should focus on: What positive response looks like. Improving security hygiene. Combining preventive actions with red team efforts.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-25878
PUBLISHED: 2022-05-27
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption ...
CVE-2021-27780
PUBLISHED: 2022-05-27
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
CVE-2021-27781
PUBLISHED: 2022-05-27
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
CVE-2022-1897
PUBLISHED: 2022-05-27
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVE-2022-20666
PUBLISHED: 2022-05-27
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient va...