Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

posted in April 2014
Post-Heartbleed: When Not To Change Your Password
Commentary  |  4/30/2014  | 
One takeaway from Heartbleed is that conventional wisdom about the need to periodically change passwords is wrong.
Mobile & Social: The Tipping Point For Cybercrime
Commentary  |  4/29/2014  | 
Spamming and scamming has moved to social media in full force, according to new research on the Twittersphere from Trend Micro.
Why Bug Bounties Are The New Normal
Commentary  |  4/28/2014  | 
Bug bounties today are big business. Find out how crowdsourcing is changing the dynamics of independent security research and vulnerability disclosure.
Data Security: Think Outside The Box
Commentary  |  4/25/2014  | 
What the public and private sector can learn from each other's data security priorities is an exercise in nuance that is well worth the effort. Here's why.
How To Detect Heartbleed Mutations
Commentary  |  4/24/2014  | 
The nightmare of Heartbleed is not the chaos of fixing the bug. It's identifying hundreds, possibly thousands, of small mutations still hiding in the network.
Workplace Data Privacy Vs. Security: The New Balance
Commentary  |  4/23/2014  | 
Is it time to rethink the traditional lock-down approach to employee use of corporate networks at work?
7 Tips To Improve 'Signal-to-Noise' In The SOC
Commentary  |  4/22/2014  | 
When security analysts are desensitized to alerts because of sheer volume, they miss the true positives that can prevent a large-scale data breach. Here's how to up your game.
FAQ: Understanding The True Price of Encryption
Commentary  |  4/21/2014  | 
In the wake of recent events like Heartbleed, the search for cost-effective, easy, and scalable encryption solutions has never been more important.
Poll: Dark Reading Community Acts On Heartbleed
Commentary  |  4/18/2014  | 
Roughly 60 percent of respondents to our flash poll have installed the Heartbeat fix or are in the process of doing so.
How A Little Obscurity Can Bolster Security
Commentary  |  4/17/2014  | 
Most security professionals deride the idea of "security by obscurity." Is it time to re-evaluate the conventional wisdom?
The Real Wakeup Call From Heartbleed
Commentary  |  4/16/2014  | 
There's nothing special about Heartbleed. Its another flaw in a popular library that exposed a lot of servers to attack. The danger lies in the way software libraries are built and whether they can be trusted.
Mobility: Who Bears The Brunt Of Data Security & Privacy
Commentary  |  4/16/2014  | 
OS manufacturers, app developers, and consumers all have a role to play in smartphone data security. But not everyone is equally responsible.
Active Directory Is Dead: 3 Reasons
Commentary  |  4/15/2014  | 
These days, Active Directory smells gangrenous to innovative companies born in the cloud and connecting customers, employees, and partners across devices at light speed.
CIO Vs. CSO: Allies Or Enemies?
Commentary  |  4/14/2014  | 
In the wake of the Target breach it's clear that the CIO and CSO must have clear boundaries of responsibility and equal representation in the board room.
'Baby Teeth' In Infrastructure Cyber Security Framework
Commentary  |  4/14/2014  | 
NISTs modest effort to improve lax security around IT infrastructure in airports, utilities, and other critical areas now heads to Congress. Don't hold your breath.
Flash Poll: Broken Heartbeat
Commentary  |  4/10/2014  | 
What steps do you plan to take in response to the Heartbleed bug? Take our poll and share your reasons in the comments.
Heartbleed: Examining The Impact
Commentary  |  4/10/2014  | 
With Heartbleed, theres little hope of knowing if an asset was breached, if a breach can be identified, or what, if any, data was leaked. Heres how to defend against future attacks.
Whats Worse: Credit Card Or Identity Theft?
Commentary  |  4/9/2014  | 
When it comes to data loss, its time for the conversation to shift from credit cards to personal information like Social Security numbers, home addresses, and your favorite flavor of ice cream.
One Year Later: The APT1 Report
Commentary  |  4/8/2014  | 
One of the most positive impacts of APT1 is the undeniable rise in the stature of the threat intelligence industry. "Threat Intelligence" is the SIEM, the NAC of 2014.
If Mother Nature Were A CISO
Commentary  |  4/7/2014  | 
There are many defensive patterns in nature that also apply to information security. Here's how to defeat your predators in the high-stakes game of corporate survival and resiliency.
We Are the Perimeter
Guest Blogs  |  4/7/2014  | 
End users, not technology, define the boundaries of the enterprise. Security strategies must protect this new perimeter.
Tech Insight: Making Data Classification Work
Commentary  |  4/4/2014  | 
Data classification involves much more than simply buying a product and dropping it in place. Here are some dos and don'ts.
NSAs Big Surprise: Govt Agency Is Actually Doing Its Job
Commentary  |  4/4/2014  | 
When people claimed after 9/11 that the NSA was ill equipped to deal with a changing world, I wonder what they expected to happen.
API-First: 3 Steps For Building Secure Cloud Apps
Commentary  |  4/3/2014  | 
When it comes to protecting data traveling to and from the cloud, today's choices are daunting. Here are three steps for making the application programming interface your new best friend.
Extra, Extra: What's New With Dark Reading News & Analysis
Commentary  |  4/2/2014  | 
How to share your opinion, news tips, and ideas.
The Right Stuff: Staffing Your Corporate SOC
Commentary  |  4/2/2014  | 
What makes a top-notch security analyst? Passion, experience, and communication skills trump certifications and degrees. But you get what you pay for.
Be Careful Beating Up Target
Commentary  |  4/1/2014  | 
Target was actually better prepared than most retailers. The real problem lies with the current state of industry threat intelligence and IR practices.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41154
PUBLISHED: 2021-10-18
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a "SVN core" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.1...
CVE-2021-41155
PUBLISHED: 2021-10-18
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix...
CVE-2021-41152
PUBLISHED: 2021-10-18
OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere on t...
CVE-2021-41153
PUBLISHED: 2021-10-18
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. Thi...
CVE-2021-41156
PUBLISHED: 2021-10-18
anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft ...