Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

posted in May 2019
Page 1 / 2   >   >>
Focusing on Endpoints: 5 Steps to Fight Cybercrime
Commentary  |  5/31/2019  | 
Follow these best practices to strengthen endpoint management strategies and protect company data.
Insider Threat: Research Proves Loyalty Can Be a Rare Commodity
Larry Loeb  |  5/31/2019  | 
The UK's Deep Secure has reported this week that the price an employee would accept to break loyalty with an organization may be a lot less than has been previously thought.
Caveat Emptor: Calculating the Impact of Global Attacks on Cyber Insurance
Commentary  |  5/30/2019  | 
The reality for business owners and CISOs looking to protect their business from a cyberattack is that cyber insurance is not a catchall for protecting against risk and loss.
The Ransomware Dilemma: What if Your Local Government Is Next?
Commentary  |  5/30/2019  | 
Baltimore has so far refused to comply with a ransom demand. It's being forced to make a decision all such victims face: to act morally or practically.
'NanshOu' China-Based Attack Uses APT-Like Techniques to Infect Servers Worldwide
Larry Loeb  |  5/30/2019  | 
Breached machines include more than 50,000 servers belonging to companies in the healthcare, telecommunications, media and IT sectors.
Don't Just Tune Your SIEM, Retune It
Commentary  |  5/29/2019  | 
Your SIEM isn't a set-it-and-forget-it proposition. It's time for a spring cleaning.
Why Fostering Flexibility Is a Win for Women & Cybersecurity
Commentary  |  5/29/2019  | 
Creating a culture of supporting and advancing women is no small feat, but it's worth the challenge. Start with yourself. Here's how.
HawkEye Malware Finds Renewed Life With Financially Motivated Actors
Larry Loeb  |  5/29/2019  | 
IBM X-Force researchers have reported an increase in the HawkEye v9 keylogger infection campaigns after they looked at data from the IBM X-Force effort during April and May 2019.
Cybercrime: Looking Beyond the Dark Web
Commentary  |  5/28/2019  | 
Fighting cybercrime requires visibility into much more than just the Dark Web. Here's where to look and a glimpse of what you'll find.
'Cattle, Not Pets' & the Rise of Security-as-Code
Commentary  |  5/28/2019  | 
Nearly a decade in, the famous analogy has underpinned a sea change in enterprise IT, but still falls short of the security mark. More recent developments can help.
Mobile Fraud Is on the March, Finds New RSA Report
Larry Loeb  |  5/28/2019  | 
The RSA Quarterly Fraud Report observed several global fraud trends across attack vectors and digital channels, with attacks from rogue mobile applications up 300%.
Zscaler Finds Security Issues Galore in IoT Traffic
Larry Loeb  |  5/24/2019  | 
The use of plain-text HTTP communication, outdated libraries and weak default credentials all rang alarm bells.
How Security Vendors Can Address the Cybersecurity Talent Shortage
Commentary  |  5/24/2019  | 
The talent gap is too large for any one sector, and cybersecurity vendors have a big role to play in helping to close it.
Google's Origin & the Danger of Link Sharing
Commentary  |  5/23/2019  | 
How the act of sharing links to files stored in a public cloud puts organizations at risk, and what security teams can do to safeguard data and PII.
Incident Response: 3 Easy Traps & How to Avoid Them
Commentary  |  5/23/2019  | 
Sage legal advice about navigating a data breach from a troubleshooting cybersecurity outside counsel.
Strategic Security Equals Faster Digital Transformation
Larry Loeb  |  5/23/2019  | 
Survey finds that respondents who adopted a more traditional or reactive approach to their data protection and security program did not believe they would reach their digital transformation goals.
Proving the Value of Security Awareness with Metrics that 'Deserve More'
Commentary  |  5/22/2019  | 
Without metrics that matter to the business, awareness programs will continue to be the bastard child of security.
The 3 Cybersecurity Rules of Trust
Commentary  |  5/22/2019  | 
Every day, keeping anything secure requires being smart about trust. The rules of trust will keep you and your data safer.
Suppliers Cut Off Huawei
Larry Loeb  |  5/22/2019  | 
If Android is to 'fork' following Huawei's isolation, the enterprise needs to begin adjusting the threat models used around employee device use.
To Narrow the Cyber Skills Gap with Attackers, Cut the Red Tape
Commentary  |  5/21/2019  | 
Attackers are getting further ahead, and entrenched corporate rules shoulder much of the blame.
Old Threats Are New Again
Commentary  |  5/21/2019  | 
They may look familiar to you, and that isn't a coincidence. New threats are often just small twists on old ones.
Does 'Client Hints' Leave Fingerprints?
Larry Loeb  |  5/21/2019  | 
New web standard allows third-party services to obtain in-depth details about another site's visitors.
Monster Breaches Do Monstrous Damage
Larry Loeb  |  5/21/2019  | 
Breaches cause massive amounts of money to fix, as a new report from Bitglass shows.
Financial Sector Under Siege
Commentary  |  5/20/2019  | 
The old take-the-money-and-run approach has been replaced by siege tactics such as DDOS attacks and land-and-expand campaigns with multiple points of persistence and increased dwell time.
Killer SecOps Skills: Soft Is the New Hard
Commentary  |  5/20/2019  | 
The sooner we give mindsets and tool sets equal bearing, the better. We must put SOC team members through rigorous training for emergency situations.
DevSecOps Enables Security to Finally Move at the Speed of the Business
Tim Woods  |  5/20/2019  | 
In the DevSecOps model, security teams are fully integrated into the DevOps process.
A Trustworthy Digital Foundation Is Essential to Digital Government
Commentary  |  5/17/2019  | 
Agencies must take steps to ensure that citizens trust in the security of government's digital channels.
How to Stop Insider Breaches From Becoming the Norm
Mark Bower  |  5/17/2019  | 
Data breaches are now so common we rarely go a day without hearing about the latest one.
The Data Problem in Security
Commentary  |  5/16/2019  | 
CISOs must consider reputation, resiliency, and regulatory impact to establish their organization's guidelines around what data matters most.
Cyber Workforce Exec Order: Right Question, Wrong Answer
Commentary  |  5/16/2019  | 
Shuffling resources, adding administrative process, and creating a competition and incentive system will do little to grow and mature the talent we need to meet the cybersecurity challenges we face.
Introducing the Digital Transformation Architect
Commentary  |  5/15/2019  | 
Bet-the-company transformation that expands the attack surface requires close alignment and leadership across executive, IT and security teams.
Cisco All at Sea Over Trust Anchor Module Vulnerability
Larry Loeb  |  5/15/2019  | 
Researchers have found ways to bypass the entire process of secure booting that the hardware was designed to support.
Windows 10 Migration: Getting It Right
Commentary  |  5/15/2019  | 
The transition to Windows 10 doesn't need to be a sprint. Organizations can still take advantage of the security in Windows 7 while gaining added management flexibility from the newer OS.
Missing in Action: Cybersecurity Professionals
Commentary  |  5/14/2019  | 
Just as every organization security team's needs are unique, so are the reasons for the shortage of candidates for open positions. Here are five strategies to help you close the gap.
SharePoint Problem Returns. Be Afraid.
Larry Loeb  |  5/14/2019  | 
Both Canada and Saudi Arabia issued alerts to the security community that they had observed traces of CVE-2019-0604 as part of other cyber attacks.
Why AI Will Create Far More Jobs Than It Replaces
Commentary  |  5/14/2019  | 
Just as spreadsheets and personal computers created a job boom in the '70s, so too will artificial intelligence spur security analysts' ability to defend against advanced threats.
How Open Testing Standards Can Improve Security
Commentary  |  5/13/2019  | 
When creating security metrics, it's critical that test methodologies cover multiple scenarios to ensure that devices perform as expected in all environments.
Study Digs the Dirt on US Cyber Hygiene
Larry Loeb  |  5/13/2019  | 
Generally it's not good, but there are a few clean-livin' types out there.
How We Collectively Can Improve Cyber Resilience
Commentary  |  5/10/2019  | 
Three steps you can take, based on Department of Homeland Security priorities.
How to Close the Critical Cybersecurity Talent Gap
Commentary  |  5/9/2019  | 
If we don't change our ways, the gap will keep getting worse. Outside-the-box thinking and new techniques are required, and here are a few ways to get started.
LightNeuron Sneaks In Through the Exchange Backdoor
Larry Loeb  |  5/9/2019  | 
A backdoor developed and disseminated by Turla is targeted at Microsoft Exchange mail servers.
Fighting Back Against Tech-Savvy Fraudsters
Commentary  |  5/9/2019  | 
Staying a step ahead requires moving beyond the security techniques of the past.
FBI: Cybercrime Losses Doubled in 2018
Commentary  |  5/8/2019  | 
The world has embraced digital technology, but cybercrime is putting a serious dent in corporate finances, the FBI finds.
The Fine Line of Feedback: 6 Tips for Talking to Security Pros
Commentary  |  5/8/2019  | 
Feedback is a two-way street in terms of giving, receiving, and knowing how to give and receive.
'MegaCortex' Ransomware Hunts 'Big Game' Enterprise
Larry Loeb  |  5/8/2019  | 
They aren't looking for a lot of little hits. They want treasure.
Serverless Computing: A New World of Security Risks
Joe Vadakkan  |  5/8/2019  | 
Serverless computing, or function-as-a-service (FaaS), is a new cloud paradigm gaining significant momentum in the developer world.
The Big E-Crime Pivot
Commentary  |  5/7/2019  | 
Criminals have begun to recognize that enterprise ransomware offers tremendous financial advantage over the more traditional tactics of wire fraud and account takeover.
Enterprise Resilience: It's the Ecosystem, Stupid
Larry Loeb  |  5/7/2019  | 
Organizations must rethink their approach to security in a way that defends not just themselves, but the entire ecosystem they inhabit, says Accenture report.
Better Behavior, Better Biometrics?
Commentary  |  5/7/2019  | 
Behavioral biometrics is a building block to be used in conjunction with other security measures, but it shows promise.
Security Workforce 2019: Closing the Gap Builds a Bridge to the Future
Steve Durbin  |  5/7/2019  | 
To plug the ongoing cybersecurity skills gap, those doing the hiring need to start thinking outside the box.
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...