Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Opinion

posted in June 2014
How Microsoft Cracks The BYOD Code: 3 Tips
Commentary  |  6/30/2014  | 
Microsofts CISO shares best-practices for balancing employee autonomy and security in todays bring-your-own world.
3 Mobile Security Tips For SMBs
Commentary  |  6/27/2014  | 
Everyone in an organization has to work together to combat intrusions and data loss, but this is especially true for small businesses.
Why A Secured Network Is Like The Human Body
Commentary  |  6/26/2014  | 
Its time to throw away the analogies about building fortresses and perimeter defenses and start to approach InfoSec with the same standard of care we use for public health.
Cloud Security: Think Todays Reality, Not Yesterdays Policy
Commentary  |  6/25/2014  | 
SaaS, BYOD, and mobility are inseparable, yet time and time again companies attempt to compartmentalize the three when they make a move to the cloud. That's a big mistake.
Crowdsourcing & Cyber Security: Who Do You Trust?
Commentary  |  6/24/2014  | 
A collective security defense can definitely tip the balance in favor of the good guys. But challenges remain.
Dark Reading Radio: RAT Exterminators
Commentary  |  6/24/2014  | 
Join us Wednesday, June 25, at 1:00 p.m. ET for a conversation with Adam Meyers, director of intelligence for CrowdStrike.
P.F. Chang's Breach Went Undetected For Months
Commentary  |  6/23/2014  | 
Early reports indicate that the compromise involved a large number of restaurant locations and dates as far back as September 2013.
Flash Poll: Critical Skills Gap In Threat Intelligence
Commentary  |  6/20/2014  | 
Our latest poll reflects members concerns over how to stay on top of the latest attack trends, defenses, and technologies.
What Workplace Privacy Will Look Like In 10 Years
Commentary  |  6/19/2014  | 
New laws like Europe's "right to be forgotten" in Google search are just the latest examples of how quickly perceptions and practices about personal privacy in the workplace are changing.
Data Security Decisions In A World Without TrueCrypt
Commentary  |  6/18/2014  | 
The last days of TrueCrypt left many unanswered questions. But one thing is certain: When encryption freeware ends its life abruptly, being a freeloader can get you into a load of trouble.
Dark Reading Radio: The Human Side Of Online Attacks
Commentary  |  6/18/2014  | 
Today's DR Radio show offers a look at phishing, social engineering, and the weakest link in the cyber defense chain: humans. Showtime is 1:00 p.m. EDT.
The Problem With Cyber Insurance
Commentary  |  6/17/2014  | 
Insurers have yet to develop an evidence-based method to assess a company's cyber risk profile. This can result in high premiums, low coverage, and broad exclusions.
A Roadmap for CIOs & CSOs After the Year of the Mega Breach
Commentary  |  6/16/2014  | 
The journey starts with three steps: Engage the C-suite, think like a hacker, and look at the big picture.
Heartbleed & The Long Tail Of Vulnerabilities
Commentary  |  6/13/2014  | 
To this day there are still unpatched systems, still hackers scanning for vulnerable systems, and still cyber criminals using Heartbleed every day to break into companies.
Monitor DNS Traffic & You Just Might Catch A RAT
Commentary  |  6/12/2014  | 
Criminals will exploit any Internet service or protocol when given the opportunity. Here are six signs of suspicious activity to watch for in the DNS.
Dont Let Lousy Teachers Sink Security Awareness
Commentary  |  6/11/2014  | 
You can't fix a human problem with a technology solution. Here are three reasons why user education can work and six tips on how to develop a corporate culture of security.
Putter Panda: Tip Of The Iceberg
Commentary  |  6/10/2014  | 
What CrowdStrike's outing of Putter Panda -- the second hacking group linked to China's spying on US defense and European satellite and aerospace industries -- means for the security industry.
Women in InfoSec: Building Bonds & New Solutions
Commentary  |  6/9/2014  | 
Learning, camaraderie, and fighting the good fight are just three reasons these women are trailblazing careers in InfoSec.
Dark Reading Radio: Breaking the Glass Ceiling in InfoSec
Commentary  |  6/6/2014  | 
Join the discussion about the challenges and rewards of being a woman in IT security from the vantage point of three accomplished security professionals. Wednesday, June 11, 2014 at 1:00 p.m. ET
If HTML5 Is The Future, What Happens To Access Control?
Commentary  |  6/5/2014  | 
The solution for multi-device deployment is HTML5. The challenge, for the enterprise, is deploying it correctly. Here are seven tools you will need.
Safely Storing User Passwords: Hashing vs. Encrypting
Commentary  |  6/4/2014  | 
Securing user information begins with a proper understanding of security controls and the protection of user passwords using modern hashing algorithms. Here's a quick review of the fundamentals.
Compliance: The Surprising Gift Of Windows XP
Commentary  |  6/3/2014  | 
The end of Windows XP will force organizations to properly reinvest in a modern and compliant desktop infrastructure that will be easier to maintain and secure.
Dark Reading Radio: Pay Up Or Never See Your Data Again
Commentary  |  6/3/2014  | 
Learn how ransomware is raising the stakes, and what law enforcement and the security community are doing about it.
How The Math Of Biometric Authentication Adds Up
Commentary  |  6/2/2014  | 
Yes, it's true that if your authentication scheme only allows a single fingerprint you only have 10 choices. But there's no rule that says it has to be one, and only one.


Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-14451
PUBLISHED: 2020-12-02
An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read which can subsequently trigger an out-of-bounds write resulting in remote code execution. An attacker can create/send m...
CVE-2017-2910
PUBLISHED: 2020-12-02
An exploitable Out-of-bounds Write vulnerability exists in the xls_addCell function of libxls 2.0. A specially crafted xls file can cause a memory corruption resulting in remote code execution. An attacker can send malicious xls file to trigger this vulnerability.
CVE-2020-13493
PUBLISHED: 2020-12-02
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. A specially crafted USDC file format path jumps decompression heap overflow in a way path jumps are processed. To trigger this vulnerability, the victim needs to open an atta...
CVE-2020-13494
PUBLISHED: 2020-12-02
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. A specially crafted malformed file can trigger a heap overflow which can result in out of bounds memory access which could lead to information disclosure. This vulnerability could...
CVE-2020-13496
PUBLISHED: 2020-12-02
An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in TfToken Type Index. This vulnerability could be used to bypass mitigations and aid further exploitation....