Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

Content posted in October 2015
The Dawn of Lights-Out Security
Commentary  |  10/30/2015  | 
In the future, the role of humans will focus on the architecture, design and automation of security, not in the actual testing or operational management.
Endpoint Security: Putting The Focus On What Matters
Partner Perspectives  |  10/29/2015  | 
Five tips to help sift through the noise and focus on actions that can dramatically impact your endpoint security program.
Machine Learning Is Cybersecuritys Latest Pipe Dream
Commentary  |  10/29/2015  | 
Rather than waste money on the unproven promises of ML and AI, invest in your experts, and in tools that enhance their ability to search for and identify components of a new attack.
The Global CISO: Why U.S. Leaders Must Think Beyond Borders
Commentary  |  10/28/2015  | 
To compete for the top cybersecurity jobs on a world stage, home-grown CISOs need to take a more international approach to professional development.
Bad News is Good News For Security Budgets But Not Skills
Commentary  |  10/27/2015  | 
Cybersecurity is finally getting the attention and dollars it deserves from the C-Suite. The challenge now is finding the talent to take full advantage of these technology investments.
New Approaches to Vendor Risk Management
Commentary  |  10/26/2015  | 
The key to managing partner security risk is having truly verifiable evidence.
Youve Been Attacked. Now What?
Commentary  |  10/23/2015  | 
The five steps you take in the first 48 hours after a breach will go a long way towards minimizing your organizations exposure and liability.
New Technology Won't Remove Endpoint From The Bullseye
Commentary  |  10/22/2015  | 
Dark Reading Radio guests from endpoint security vendor Tanium and Intel Security/McAfee may have different product views, but they concur on the problems plaguing end user machines.
To Find The Needle, Chop Down the Haystack: 5 Steps For Effective Threat Monitoring
Commentary  |  10/22/2015  | 
Would bank security screen everyone entering the building then leave the vault door open with no one watching the money? Of course not!
Navigating New Security Architectures For Cloud Data Centers
Commentary  |  10/21/2015  | 
Micro-segmentation is a revolutionary approach to data center complexity and security. But not all architectures are created equal.
Building A Winning Security Team From The Top Down
Commentary  |  10/20/2015  | 
Dropbox security chief Patrick Heim dishes about the need for strong industry leaders, the 'unique' cybersecurity personality and why successful organizations need 'cupcake.'
Next On Dark Reading Radio: Endpoint Security Transformed
Commentary  |  10/19/2015  | 
Modern endpoint security technology is all about focusing on the client as both patient 0 and as a treasure trove of attack forensics intelligence.
Are You Making This Endpoint Security Mistake?
Partner Perspectives  |  10/19/2015  | 
Detecting threats isnt enough. You must also remediate vulnerable endpoints and employ continuous monitoring to reduce exposure.
Secure Software Development in the IoT: 5 Golden Rules
Commentary  |  10/19/2015  | 
The evolving threat landscape doesnt merely expose developers to new problems. It exposes them to old problems that they need to address sooner, faster, and more frequently.
The Internet of Things: Its All About Trust
Commentary  |  10/16/2015  | 
As billions of devices come online, it will be critical to protect the keys and certificates we use for authentication, validation, and privileged access control.
An Atypical Approach To DNS
Commentary  |  10/15/2015  | 
Its now possible to architect network instrumentation to collect fewer data sources of higher value to security operations. Heres how -- and why -- you should care.
Asset Segmentation: The Key To Control
Partner Perspectives  |  10/15/2015  | 
Automated asset segmentation and classification helps focus strong security controls where they are needed most.
'POODLE' One Year Later: Still Around? Not So Much
Commentary  |  10/14/2015  | 
As high-severity vulnerabilities go, POODLE remediation rates and times have proven to be astonishingly better than expected.
Why DevOps Fails At Application Security
Commentary  |  10/13/2015  | 
In a recent survey of developers, nearly half of respondents admit to releasing applications with known vulnerabilities at least 80 percent of the time.
Police Car Hacks: Under The Hood
Commentary  |  10/12/2015  | 
A closer look at how researchers hacked two Virginia State Trooper vehicles.
Cybersecurity Insurance: 4 Practical Considerations
Commentary  |  10/12/2015  | 
There can't be reliable cybersecurity insurance until companies can identify who is responsible for the continuous exploitation of stolen data, long-lasting attacks, and hardly-detectable APTs.
Jailbreaking Mobile Devices: Thats Not The Real Problem
Commentary  |  10/9/2015  | 
Despite what mobile operating system vendors say, its the OS flaws that put everyone at risk.
Chipping Away At Credit Card Fraud With EMV
Commentary  |  10/8/2015  | 
As of October 1, so-called chip-and-pin technology is now the law of the land for electronic payments in the US. But its not the silver bullet that will instantly stop all cybercrime.
Intro To Machine Learning & Cybersecurity: 5 Key Steps
Commentary  |  10/7/2015  | 
Software-based machine learning attempts to emulate the same process that the brain uses. Heres how.
What The EUs Safe Harbor Ruling Means For Data Privacy In The Cloud
Commentary  |  10/6/2015  | 
The European Court of Justice today struck down the 15-year-old data transfer agreement between the European Union and the US. Heres how to begin to prepare for the fallout.
Dont Be Fooled: In Cybersecurity Big Data Is Not The Goal
Commentary  |  10/6/2015  | 
In other words, the skills to be a security expert do not translate to being able to understand and extract meaning from security data.
Segmentation: A Fire Code For Network Security
Commentary  |  10/5/2015  | 
New technologies like software-defined segmentation are making it easier to prevent a compromise from spreading by separating users and network resources into zones.
Youre Doing BYOD Wrong: These Numbers Prove It
Partner Perspectives  |  10/5/2015  | 
Almost 40% of users who connect personal mobile devices to corporate networks have no lock-screen mechanism set in place.
The Evolution Of Malware
Commentary  |  10/2/2015  | 
Like the poor in the famous Biblical verse, malware will always be with us. Heres a 33-year history from Elk Cloner to Cryptolocker. What will be next?
Automating Breach Detection For The Way Security Professionals Think
Commentary  |  10/1/2015  | 
The missing ingredient in making a real difference in the cumbersome process of evaluating a flood of alerts versus a small, actionable number is context.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15703
PUBLISHED: 2020-10-31
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivile...
CVE-2020-5991
PUBLISHED: 2020-10-30
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
CVE-2020-15273
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can ac...
CVE-2020-15276
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
CVE-2020-15277
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.