Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

posted in March 2018
Page 1 / 2   >   >>
The Cybersecurity Mandates Keep On Coming
Commentary  |  3/30/2018  | 
There's a good reason for the proliferation of mandates like the one in New York state, but companies may struggle to answer this question: "Are we in compliance?"
VPNs Are Still Leaking Your Personal Information
Larry Loeb  |  3/30/2018  | 
While VPNs are supposed to allow for safe, anonymous browsing, it turns out that STUN servers on the backend can still leak personal information and your whereabouts. Here's how to minimize that.
GDPR, AI & a New Age of Consent for Enterprises
Joe Stanganelli  |  3/30/2018  | 
Despite compliance worries under GDPR, obtaining necessary consent for AI and machine learning processing of personal data is far from impossible.
Deconstructing the DOJ Iranian Hacking Indictment
Commentary  |  3/29/2018  | 
The alleged attackers used fairly simple tools, techniques and procedures to compromise a new victim organization on an almost weekly basis for over five years.
Atlanta, Baltimore Ransomware Attacks Show Government Agencies' Vulnerabilities
Dawn Kawamoto  |  3/29/2018  | 
With ransomware attacks causing havoc in Atlanta and Baltimore, security experts said government agencies tend to fare worse in a cyber attack than Fortune 500 companies and private industry.
Deconstructing a Business Email Compromise Attack
Partner Perspectives  |  3/29/2018  | 
How a tech-savvy New Jersey couple outwitted a German hacker group and saved their home and life savings.
How Measuring Security for Risk & ROI Can Empower CISOs
Commentary  |  3/28/2018  | 
For the vast majority of business decisions, organizations seek metrics-driven proof. Why is cybersecurity the exception?
Automating Ethics for Cybersecurity
Commentary  |  3/28/2018  | 
Having a code of ethics and enforcing it are two different things.
Researcher Finds etcd Servers Leak Passwords Like a Sieve
Larry Loeb  |  3/28/2018  | 
Security researchers find that etcd servers, an essential part of Kubernetes, as well as other database system, have been leaking passwords for a long time.
Getting Ahead of Internet of Things Security in the Enterprise
Partner Perspectives  |  3/28/2018  | 
In anticipation of an IoT-centric future, CISOs must be rigorous in shoring up defenses that provide real-time insights across all network access points.
Why Privileged Account Management Is So Difficult for Enterprises
Simon Marshall  |  3/28/2018  | 
A report from security firm Thycotic finds that enterprises struggle with protecting Privileged Account Management from outside attacks. However, there are better ways to protect data.
UVA Defeats UMBC, in Stunning Upset
Commentary  |  3/27/2018  | 
In first trip to Mid-Atlantic Collegiate Cyber Defense Competition, University of Virginia's Cyber Defense Team defeats reigning national champs from University of Maryland, Baltimore County.
780 Days in the Life of a Computer Worm
Commentary  |  3/27/2018  | 
This is a story of a worm, from the time it was coded and deployed onto the Internet. It is narrated by the worm in the first person.
Healthcare Industry Underprepared for Cyber Attacks Report
Simon Marshall  |  3/27/2018  | 
A study from Merlin International finds that healthcare facilities and businesses are underprepared for cyber attacks, and that patient data remains at risk.
Privacy: Do We Need a National Data Breach Disclosure Law?
Commentary  |  3/27/2018  | 
Some say we need a more consistent approach, while others worry a national law might supersede and water down some state laws already on the books.
Facebook Privacy Policy Is Under Investigation by FTC
Dawn Kawamoto  |  3/27/2018  | 
Federal Trade Commission reveals it is conducting an open investigation into Facebook's privacy practices, as news reports surface about the social media giant collecting phone call and text message data on its users.
The Overlooked Problem of 'N-Day' Vulnerabilities
Commentary  |  3/26/2018  | 
N-days -- or known vulnerabilities -- are a goldmine for attackers of industrial control systems. It's time for a new defense strategy.
Cybercriminals Using Kubernetes, Docker to Bitcoin Mine
Larry Loeb  |  3/26/2018  | 
Supposedly safe and secure Docker containers and the Kubernetes orchestration system can actually be manipulated to mine Bitcoin and other cryptocurrencies, researchers have found.
As Ransomware Declines, Atlanta Is Odd Man Out
Dawn Kawamoto  |  3/26/2018  | 
Atlanta took a high-profile hit last week as cyber thieves launched a ransomware attack against the city, a move that comes as the IT industry sees a 70% drop in such attacks.
Looking Back to Look Ahead: Cyber Threat Trends to Watch
Commentary  |  3/23/2018  | 
Data from the fourth quarter of last year shows the state of application exploits, malicious software, and botnets.
In Facebook Debacle, More Than Zuckerberg to Blame
Larry Loeb  |  3/23/2018  | 
Facebook and CEO Mark Zuckerberg are rightly taking a lot of heat from the fallout over Cambridge Analytica and the firm's use of social media data. However, other businesses, as well as users, need to take some responsibility as well.
Cybersecurity AI: Addressing the 'Artificial' Talent Shortage
Joe Stanganelli  |  3/23/2018  | 
As AI becomes increasingly important to cybersecurity, industry's complaints on the talent shortages in both areas have become louder. However, is there really a lack of qualified experts?
Is Application Security Dead?
Commentary  |  3/22/2018  | 
The nature of the field has changed greatly because of the move to the cloud and enterprise digital transformation.
5 Ways to Get Ready for Public Cloud Deployment
Commentary  |  3/22/2018  | 
Syncing security and product development early is now a "must do."
Applications & Identities Initial Targets in 86% of Breaches: Report
Partner Perspectives  |  3/22/2018  | 
The startling numbers of breached data are sobering: 11.8 billion records compromised in 337 of 433 incidents examined by F5 researchers. They include 10.3 billion usernames, passwords, and email accounts.
Crypto Crumple: A New Method of Balancing Privacy & Security
Larry Loeb  |  3/22/2018  | 
In a new paper released this week, two professors describe what they call the "crypto crumple zone," which looks to balance encryption and privacy with government's ability to investigate possible crimes.
SOC in Translation: 4 Common Phrases & Why They Raise Flags
Commentary  |  3/21/2018  | 
By keeping an ear out for out for catchphrases like "Just ask Stu" or "I've got a bad feeling about this," CISOs can overcome the barriers that get between business leaders and their security teams.
How Serverless Computing Reshapes Security
Commentary  |  3/21/2018  | 
The new division of responsibility moves some security concerns off a business's plate while changing priorities for other risks.
Cybersecurity Spring Cleaning: 3 Must-Dos for 2018
Partner Perspectives  |  3/21/2018  | 
Why 'Spectre' and 'Meltdown,' GDPR, and the Internet of Things are three areas security teams should declutter and prioritize in the coming months.
Oil & Gas Industry Face Significant Cybersecurity Threat Study
Larry Loeb  |  3/21/2018  | 
A Ponemon survey finds a growing concern among cybersecurity professionals who work in the world's oil and gas industries.\r\n\r\n
Critical Infrastructure: Stop Whistling Past the Cyber Graveyard
Commentary  |  3/20/2018  | 
An open letter to former colleagues in Homeland Security, peers in private sector cybersecurity firms, those who own and operate critical systems, academics, and politicians.
The Case for Integrating Physical Security & Cybersecurity
Commentary  |  3/20/2018  | 
Aggregating threat intel from external data sources is no longer enough. You must look inside and outside your traditional knowledge base for the best way to defend against attacks.
How to Access the Voter Information Dirt Cambridge Analytica Has on You
Dawn Kawamoto  |  3/20/2018  | 
UK-based Cambridge Analytica and its parent company are embroiled in controversy after amassing Facebook data on 270,000 users to influence election outcomes. Here's how to find out the dirt they have on you.
AI Is Stealing These IT Security Jobs Now
Dawn Kawamoto  |  3/20/2018  | 
Besides the current crop of jobs AI is stealing, other InfoSec roles are also potentially next unless professionals safeguard their careers by repositioning their skills, say IT security and careers experts.
A Data Protection Officer's Guide to the GDPR Galaxy
Commentary  |  3/19/2018  | 
Impending deadline got you freaking out? These five tips might help you calm down, at least a little.
IoT Use Complicates Security Landscape in Healthcare
Simon Marshall  |  3/19/2018  | 
As billions of IoT devices are coming online, especially in healthcare, the security landscape is getting increasingly complicated, according to a report from Zingbox.
Fancy Bear Linked to DealersChoice Attacks in Europe
Larry Loeb  |  3/19/2018  | 
Researchers at Palo Alto Networks believe the Russia-linked Fancy Bear group is behind a new exploit called DealersChoice that is targeting European governments and agencies.
The Containerization of Artificial Intelligence
Commentary  |  3/16/2018  | 
AI automates repetitive tasks and alleviates mundane functions that often haunt decision makers. But it's still not a sure substitute for security best practices.
Government Workers Believe Security Is Someone Else's Job
Larry Loeb  |  3/16/2018  | 
A study from Dtex Systems finds a growing disconnect between government employees and the organizations that they work for over who is ultimately responsible for maintaining good security practices.
Online Ads vs. Security: An Invisible War
Commentary  |  3/15/2018  | 
Why visiting one website is like visiting 50, and how you can fight back against malvertisers.
Voice-Operated Devices, Enterprise Security & the 'Big Truck' Attack
Commentary  |  3/15/2018  | 
The problem with having smart speakers and digital assistants in the workplace is akin to having a secure computer inside your office while its wireless keyboard is left outside for everyone to use.
AI: An Emerging Insider Threat?
Dawn Kawamoto  |  3/15/2018  | 
As artificial intelligence increasingly gains a presence in the enterprise, concerns are already being raised of a new insider threat where AI will turn against its operators. How can security experts address this "frenemy"?
Segmentation: The Neglected (Yet Essential) Control
Commentary  |  3/14/2018  | 
Failure to deploy measures to contain unauthorized intruders is a recipe for digital disaster.
A Secure Enterprise Starts with a Cyber-Aware Staff
Commentary  |  3/14/2018  | 
An attack doesn't have to be super high-tech to cause a lot of damage. Make sure your employees know how to spot an old-fashioned phishing campaign.
AMD Chips Have Their Own Massive Hardware Security Flaws
Larry Loeb  |  3/14/2018  | 
CTS-Labs issued a report this week that detailed 13 different vulnerabilities in AMD's Ryzen and EPYC processors that are as dangerous as the Spectre and Meltdown flaws that Intel has been trying to fix.
How to Interpret the SECs Latest Guidance on Data Breach Disclosure
Partner Perspectives  |  3/14/2018  | 
Forward-looking organizations should view this as an opportunity to reevaluate their cybersecurity posture and install best practices that should have already been in place.
Fortnite Players Lob Shots at Epic Games Over Hacked Accounts
Dawn Kawamoto  |  3/14/2018  | 
A number of Fortnite players recently suffered a breach of their Epic Game accounts, costing them hundreds of dollars and leaving them frustrated when they could not immediately reach the company for a refund.
Google 'Distrust Dates' Are Coming Fast
Commentary  |  3/13/2018  | 
All the tools are in place for the migration of SSL digital certificates on a scale that is unprecedented for the certificate authority industry. Are you ready?
What's the C-Suite Doing About Mobile Security?
Commentary  |  3/13/2018  | 
While most companies have security infrastructure for on-premises servers, networks, and endpoints, too many are ignoring mobile security. They'd better get moving.
Disappearing Act: Dark Reading Caption Contest Winners
Commentary  |  3/12/2018  | 
A standout field with hysterical puns about security policies, Meltdown, Amazon Web Services, and the right to be forgotten. And the winner is
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...