Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

Content posted in September 2006
Quick, Encrypt Everything!
Commentary  |  9/22/2006  | 
On the surface, it seems like a good idea. Convert all your corporate information into a form unreadable by anyone except the intended recipient. Very straightforward and not terribly difficult to do. But there's a dark side to encryption. Just like anesthesiologists like to joke that putting you under is free, it's waking you up that costs so much money, decrypting your data is the part of the process where things get hairy. In this era of epidemically stolen and lost laptops and mobile devices
Spinach Woes Portend Repercussions Of Cyberattack
Commentary  |  9/19/2006  | 
Wonder what the aftereffect of a terrorist attack on the Internet would look like? The way we're responding to contaminated spinach provides a clue.
Data Protection: It Doesn't Get Any Better Than This
Commentary  |  9/13/2006  | 
Corporate America's efforts at data protection--in particular, protecting sensitive personal information about customers--have in many cases failed miserably. There's a long and dubious list of data breaches, losses, thefts, and mishandlings from the past 20 months, with the total number of records containing sensitive personal information involved in security breaches now topping 93 million. Time and again, we've taken to task
HP Must Rebuild The Damage To Its Image
Commentary  |  9/11/2006  | 
Like most everyone, I've been thinking about the victims of Sept. 11, 2001, in the past few days. I'm also remembering former Hewlett-Packard Chairman Lew Platt, who died on Sept. 8 of last year, as his former company faces a criminal investigation into tactics used to hunt down the source of media leaks.
Post 9/11: Five Years Of IT Promise And Failure
Commentary  |  9/8/2006  | 
Sept. 11, 2001, spurred IT innovation and integration like no other event in history. Driven by fear, defiance, and inspiration, industry and government quickly promised to correct the conditions--including siloed data repositories, incompatible communications systems, and lax security practices--that allowed the terrorist attacks to be executed with such deadly precision. How far have we come in five years? Let's put it this way: We've got a long way to go.
Airing Dirty Security Laundry
Commentary  |  9/5/2006  | 
We all need to be smart, stay informed, and understand our systems well enough to figure out what needs fixing first, or risk being out of business. No vendor, well-intentioned or not, can make these decisions for us; we need to take this responsibility for ourselves.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-42556
PUBLISHED: 2021-10-22
Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model archive, an attacker has arbitrary write capability within specific directories via a crafted archive file.
CVE-2021-42840
PUBLISHED: 2021-10-22
SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blo...
CVE-2021-29835
PUBLISHED: 2021-10-22
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X...
CVE-2021-41171
PUBLISHED: 2021-10-22
eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing bru...
CVE-2021-42836
PUBLISHED: 2021-10-22
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.