Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

Content posted in March 2018
Page 1 / 2   >   >>
The Cybersecurity Mandates Keep On Coming
Commentary  |  3/30/2018  | 
There's a good reason for the proliferation of mandates like the one in New York state, but companies may struggle to answer this question: "Are we in compliance?"
VPNs Are Still Leaking Your Personal Information
Larry Loeb  |  3/30/2018  | 
While VPNs are supposed to allow for safe, anonymous browsing, it turns out that STUN servers on the backend can still leak personal information and your whereabouts. Here's how to minimize that.
GDPR, AI & a New Age of Consent for Enterprises
Joe Stanganelli  |  3/30/2018  | 
Despite compliance worries under GDPR, obtaining necessary consent for AI and machine learning processing of personal data is far from impossible.
Deconstructing the DOJ Iranian Hacking Indictment
Commentary  |  3/29/2018  | 
The alleged attackers used fairly simple tools, techniques and procedures to compromise a new victim organization on an almost weekly basis for over five years.
Atlanta, Baltimore Ransomware Attacks Show Government Agencies' Vulnerabilities
Dawn Kawamoto  |  3/29/2018  | 
With ransomware attacks causing havoc in Atlanta and Baltimore, security experts said government agencies tend to fare worse in a cyber attack than Fortune 500 companies and private industry.
Deconstructing a Business Email Compromise Attack
Partner Perspectives  |  3/29/2018  | 
How a tech-savvy New Jersey couple outwitted a German hacker group and saved their home and life savings.
How Measuring Security for Risk & ROI Can Empower CISOs
Commentary  |  3/28/2018  | 
For the vast majority of business decisions, organizations seek metrics-driven proof. Why is cybersecurity the exception?
Automating Ethics for Cybersecurity
Commentary  |  3/28/2018  | 
Having a code of ethics and enforcing it are two different things.
Researcher Finds etcd Servers Leak Passwords Like a Sieve
Larry Loeb  |  3/28/2018  | 
Security researchers find that etcd servers, an essential part of Kubernetes, as well as other database system, have been leaking passwords for a long time.
Getting Ahead of Internet of Things Security in the Enterprise
Partner Perspectives  |  3/28/2018  | 
In anticipation of an IoT-centric future, CISOs must be rigorous in shoring up defenses that provide real-time insights across all network access points.
Why Privileged Account Management Is So Difficult for Enterprises
Simon Marshall  |  3/28/2018  | 
A report from security firm Thycotic finds that enterprises struggle with protecting Privileged Account Management from outside attacks. However, there are better ways to protect data.
UVA Defeats UMBC, in Stunning Upset
Commentary  |  3/27/2018  | 
In first trip to Mid-Atlantic Collegiate Cyber Defense Competition, University of Virginia's Cyber Defense Team defeats reigning national champs from University of Maryland, Baltimore County.
780 Days in the Life of a Computer Worm
Commentary  |  3/27/2018  | 
This is a story of a worm, from the time it was coded and deployed onto the Internet. It is narrated by the worm in the first person.
Healthcare Industry Underprepared for Cyber Attacks Report
Simon Marshall  |  3/27/2018  | 
A study from Merlin International finds that healthcare facilities and businesses are underprepared for cyber attacks, and that patient data remains at risk.
Privacy: Do We Need a National Data Breach Disclosure Law?
Commentary  |  3/27/2018  | 
Some say we need a more consistent approach, while others worry a national law might supersede and water down some state laws already on the books.
Facebook Privacy Policy Is Under Investigation by FTC
Dawn Kawamoto  |  3/27/2018  | 
Federal Trade Commission reveals it is conducting an open investigation into Facebook's privacy practices, as news reports surface about the social media giant collecting phone call and text message data on its users.
The Overlooked Problem of 'N-Day' Vulnerabilities
Commentary  |  3/26/2018  | 
N-days -- or known vulnerabilities -- are a goldmine for attackers of industrial control systems. It's time for a new defense strategy.
Cybercriminals Using Kubernetes, Docker to Bitcoin Mine
Larry Loeb  |  3/26/2018  | 
Supposedly safe and secure Docker containers and the Kubernetes orchestration system can actually be manipulated to mine Bitcoin and other cryptocurrencies, researchers have found.
As Ransomware Declines, Atlanta Is Odd Man Out
Dawn Kawamoto  |  3/26/2018  | 
Atlanta took a high-profile hit last week as cyber thieves launched a ransomware attack against the city, a move that comes as the IT industry sees a 70% drop in such attacks.
Looking Back to Look Ahead: Cyber Threat Trends to Watch
Commentary  |  3/23/2018  | 
Data from the fourth quarter of last year shows the state of application exploits, malicious software, and botnets.
In Facebook Debacle, More Than Zuckerberg to Blame
Larry Loeb  |  3/23/2018  | 
Facebook and CEO Mark Zuckerberg are rightly taking a lot of heat from the fallout over Cambridge Analytica and the firm's use of social media data. However, other businesses, as well as users, need to take some responsibility as well.
Cybersecurity AI: Addressing the 'Artificial' Talent Shortage
Joe Stanganelli  |  3/23/2018  | 
As AI becomes increasingly important to cybersecurity, industry's complaints on the talent shortages in both areas have become louder. However, is there really a lack of qualified experts?
Is Application Security Dead?
Commentary  |  3/22/2018  | 
The nature of the field has changed greatly because of the move to the cloud and enterprise digital transformation.
5 Ways to Get Ready for Public Cloud Deployment
Commentary  |  3/22/2018  | 
Syncing security and product development early is now a "must do."
Applications & Identities Initial Targets in 86% of Breaches: Report
Partner Perspectives  |  3/22/2018  | 
The startling numbers of breached data are sobering: 11.8 billion records compromised in 337 of 433 incidents examined by F5 researchers. They include 10.3 billion usernames, passwords, and email accounts.
Crypto Crumple: A New Method of Balancing Privacy & Security
Larry Loeb  |  3/22/2018  | 
In a new paper released this week, two professors describe what they call the "crypto crumple zone," which looks to balance encryption and privacy with government's ability to investigate possible crimes.
SOC in Translation: 4 Common Phrases & Why They Raise Flags
Commentary  |  3/21/2018  | 
By keeping an ear out for out for catchphrases like "Just ask Stu" or "I've got a bad feeling about this," CISOs can overcome the barriers that get between business leaders and their security teams.
How Serverless Computing Reshapes Security
Commentary  |  3/21/2018  | 
The new division of responsibility moves some security concerns off a business's plate while changing priorities for other risks.
Cybersecurity Spring Cleaning: 3 Must-Dos for 2018
Partner Perspectives  |  3/21/2018  | 
Why 'Spectre' and 'Meltdown,' GDPR, and the Internet of Things are three areas security teams should declutter and prioritize in the coming months.
Oil & Gas Industry Face Significant Cybersecurity Threat Study
Larry Loeb  |  3/21/2018  | 
A Ponemon survey finds a growing concern among cybersecurity professionals who work in the world's oil and gas industries.\r\n\r\n
Critical Infrastructure: Stop Whistling Past the Cyber Graveyard
Commentary  |  3/20/2018  | 
An open letter to former colleagues in Homeland Security, peers in private sector cybersecurity firms, those who own and operate critical systems, academics, and politicians.
The Case for Integrating Physical Security & Cybersecurity
Commentary  |  3/20/2018  | 
Aggregating threat intel from external data sources is no longer enough. You must look inside and outside your traditional knowledge base for the best way to defend against attacks.
How to Access the Voter Information Dirt Cambridge Analytica Has on You
Dawn Kawamoto  |  3/20/2018  | 
UK-based Cambridge Analytica and its parent company are embroiled in controversy after amassing Facebook data on 270,000 users to influence election outcomes. Here's how to find out the dirt they have on you.
AI Is Stealing These IT Security Jobs Now
Dawn Kawamoto  |  3/20/2018  | 
Besides the current crop of jobs AI is stealing, other InfoSec roles are also potentially next unless professionals safeguard their careers by repositioning their skills, say IT security and careers experts.
A Data Protection Officer's Guide to the GDPR Galaxy
Commentary  |  3/19/2018  | 
Impending deadline got you freaking out? These five tips might help you calm down, at least a little.
IoT Use Complicates Security Landscape in Healthcare
Simon Marshall  |  3/19/2018  | 
As billions of IoT devices are coming online, especially in healthcare, the security landscape is getting increasingly complicated, according to a report from Zingbox.
Fancy Bear Linked to DealersChoice Attacks in Europe
Larry Loeb  |  3/19/2018  | 
Researchers at Palo Alto Networks believe the Russia-linked Fancy Bear group is behind a new exploit called DealersChoice that is targeting European governments and agencies.
The Containerization of Artificial Intelligence
Commentary  |  3/16/2018  | 
AI automates repetitive tasks and alleviates mundane functions that often haunt decision makers. But it's still not a sure substitute for security best practices.
Government Workers Believe Security Is Someone Else's Job
Larry Loeb  |  3/16/2018  | 
A study from Dtex Systems finds a growing disconnect between government employees and the organizations that they work for over who is ultimately responsible for maintaining good security practices.
Online Ads vs. Security: An Invisible War
Commentary  |  3/15/2018  | 
Why visiting one website is like visiting 50, and how you can fight back against malvertisers.
Voice-Operated Devices, Enterprise Security & the 'Big Truck' Attack
Commentary  |  3/15/2018  | 
The problem with having smart speakers and digital assistants in the workplace is akin to having a secure computer inside your office while its wireless keyboard is left outside for everyone to use.
AI: An Emerging Insider Threat?
Dawn Kawamoto  |  3/15/2018  | 
As artificial intelligence increasingly gains a presence in the enterprise, concerns are already being raised of a new insider threat where AI will turn against its operators. How can security experts address this "frenemy"?
Segmentation: The Neglected (Yet Essential) Control
Commentary  |  3/14/2018  | 
Failure to deploy measures to contain unauthorized intruders is a recipe for digital disaster.
A Secure Enterprise Starts with a Cyber-Aware Staff
Commentary  |  3/14/2018  | 
An attack doesn't have to be super high-tech to cause a lot of damage. Make sure your employees know how to spot an old-fashioned phishing campaign.
AMD Chips Have Their Own Massive Hardware Security Flaws
Larry Loeb  |  3/14/2018  | 
CTS-Labs issued a report this week that detailed 13 different vulnerabilities in AMD's Ryzen and EPYC processors that are as dangerous as the Spectre and Meltdown flaws that Intel has been trying to fix.
How to Interpret the SECs Latest Guidance on Data Breach Disclosure
Partner Perspectives  |  3/14/2018  | 
Forward-looking organizations should view this as an opportunity to reevaluate their cybersecurity posture and install best practices that should have already been in place.
Fortnite Players Lob Shots at Epic Games Over Hacked Accounts
Dawn Kawamoto  |  3/14/2018  | 
A number of Fortnite players recently suffered a breach of their Epic Game accounts, costing them hundreds of dollars and leaving them frustrated when they could not immediately reach the company for a refund.
Google 'Distrust Dates' Are Coming Fast
Commentary  |  3/13/2018  | 
All the tools are in place for the migration of SSL digital certificates on a scale that is unprecedented for the certificate authority industry. Are you ready?
What's the C-Suite Doing About Mobile Security?
Commentary  |  3/13/2018  | 
While most companies have security infrastructure for on-premises servers, networks, and endpoints, too many are ignoring mobile security. They'd better get moving.
Disappearing Act: Dark Reading Caption Contest Winners
Commentary  |  3/12/2018  | 
A standout field with hysterical puns about security policies, Meltdown, Amazon Web Services, and the right to be forgotten. And the winner is
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7700
PUBLISHED: 2020-08-14
All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
CVE-2020-7701
PUBLISHED: 2020-08-14
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
CVE-2020-9228
PUBLISHED: 2020-08-14
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information, attackers may exploit this vulnerability to obtain certain information.
CVE-2020-9229
PUBLISHED: 2020-08-14
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information, attackers may exploit this vulnerability to obtain certain information.
CVE-2019-19643
PUBLISHED: 2020-08-14
ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service.