Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content posted in March 2018
<<   <   Page 2 / 5   >   >>
In Facebook Debacle, More Than Zuckerberg to Blame
Larry Loeb  |  3/23/2018  | 
Facebook and CEO Mark Zuckerberg are rightly taking a lot of heat from the fallout over Cambridge Analytica and the firm's use of social media data. However, other businesses, as well as users, need to take some responsibility as well.
Cybersecurity AI: Addressing the 'Artificial' Talent Shortage
Joe Stanganelli  |  3/23/2018  | 
As AI becomes increasingly important to cybersecurity, industry's complaints on the talent shortages in both areas have become louder. However, is there really a lack of qualified experts?
New Survey Illustrates Real-World Difficulties in Cloud Security
News  |  3/22/2018  | 
Depending on traditional models makes cloud security more challenging for organizations, according to a Barracuda Networks report.
Criminals Using Web Injects to Steal Cryptocurrency
News  |  3/22/2018  | 
Man-in-the-browser attacks targeting Blockchain.info and Coinbase websites, SecurityScorecard says.
Is Application Security Dead?
Commentary  |  3/22/2018  | 
The nature of the field has changed greatly because of the move to the cloud and enterprise digital transformation.
Hunting Cybercriminals with AWS Honey Tokens
News  |  3/22/2018  | 
Researchers at Black Hat Asia demonstrated how they used AWS honey tokens to detect security breaches at scale.
US Federal Spending Bill Includes $380 Million for Securing Election Systems
Quick Hits  |  3/22/2018  | 
Spending bill includes election technology grants for states to shore up security of their voting systems, reports say.
Google Launches DDoS Protection, Cloud Security Controls & More
News Analysis-Security Now  |  3/22/2018  | 
Cloud Armor provides protection against Distributed Denial of Service (DDoS) attacks, and Google also provided improved controls for cloud security admins on both Google Cloud Platform and G Suite.
5 Ways to Get Ready for Public Cloud Deployment
Commentary  |  3/22/2018  | 
Syncing security and product development early is now a "must do."
GDPR Compliance: Enterprises Have Two Options to Consider
News Analysis-Security Now  |  3/22/2018  | 
When it comes to preparing for GDPR, enterprises, as well as vendors, are relying on two different approaches. The first focuses on technology, while the second relies on internal processes and workflows.
7 Ways to Protect Against Cryptomining Attacks
Slideshows  |  3/22/2018  | 
Implementing basic security hygiene can go a long way in ensuring your systems and website don't get hijacked.
Applications & Identities Initial Targets in 86% of Breaches: Report
Partner Perspectives  |  3/22/2018  | 
The startling numbers of breached data are sobering: 11.8 billion records compromised in 337 of 433 incidents examined by F5 researchers. They include 10.3 billion usernames, passwords, and email accounts.
Crypto Crumple: A New Method of Balancing Privacy & Security
Larry Loeb  |  3/22/2018  | 
In a new paper released this week, two professors describe what they call the "crypto crumple zone," which looks to balance encryption and privacy with government's ability to investigate possible crimes.
Supply Chain Cyberattacks Surged 200% in 2017
News  |  3/22/2018  | 
Symantec's annual Internet Security Threat Report also shows that zero-day exploits fizzled and cryptocurrency mining exploded.
GandCrab Ransomware Goes 'Agile'
News  |  3/21/2018  | 
GandCrab ransomware's developers have iterated the code rapidly, researchers found.
Gartner Expects 2018 IoT Security Spending to Reach $1.5 Billion
News  |  3/21/2018  | 
Regulations, breach concerns will push spending to over $3 billion by 2021, analyst firm says.
SOC in Translation: 4 Common Phrases & Why They Raise Flags
Commentary  |  3/21/2018  | 
By keeping an ear out for out for catchphrases like "Just ask Stu" or "I've got a bad feeling about this," CISOs can overcome the barriers that get between business leaders and their security teams.
DHS Chief: Election Security Now Top Priority Among Critical Systems
Quick Hits  |  3/21/2018  | 
Homeland Security Secretary Kirstjen Nielsen told Congress today that her department is working to assist states with their election systems' security.
Puerto Rico's Electric Utility Hacked in Weekend Attack
Quick Hits  |  3/21/2018  | 
Service was disrupted but no customer records compromised, officials said.
How Serverless Computing Reshapes Security
Commentary  |  3/21/2018  | 
The new division of responsibility moves some security concerns off a business's plate while changing priorities for other risks.
Online Sandboxing: A Stash for Exfiltrated Data?
News  |  3/21/2018  | 
SafeBreach researchers extend leaky sandbox research to show how services like VirusTotal and Hybrid Analysis could be used to steal data from air-gapped systems.
ISF: Nation States, AI Will Upend Enterprise Security
News Analysis-Security Now  |  3/21/2018  | 
In its annual look ahead at the changing security landscape, the Information Security Form finds that attacks by nation states against businesses, as well as how AI and machine learning are used, are the biggest challenges within enterprise security.
Cybersecurity Spring Cleaning: 3 Must-Dos for 2018
Partner Perspectives  |  3/21/2018  | 
Why 'Spectre' and 'Meltdown,' GDPR, and the Internet of Things are three areas security teams should declutter and prioritize in the coming months.
Oil & Gas Industry Face Significant Cybersecurity Threat Study
Larry Loeb  |  3/21/2018  | 
A Ponemon survey finds a growing concern among cybersecurity professionals who work in the world's oil and gas industries.\r\n\r\n
A Look at Cybercrime's Banal Nature
News  |  3/20/2018  | 
Cybercrime is becoming a more boring business, a new report shows, and that's a huge problem for victims and law enforcement.
Azure Guest Agent Design Enables Plaintext Password Theft
News  |  3/20/2018  | 
Researchers find attackers can abuse the design of Microsoft Azure Guest Agent to recover plaintext administrator passwords.
Critical Infrastructure: Stop Whistling Past the Cyber Graveyard
Commentary  |  3/20/2018  | 
An open letter to former colleagues in Homeland Security, peers in private sector cybersecurity firms, those who own and operate critical systems, academics, and politicians.
Hackers Steal Payment Card Data on 880K from Expedia Orbitz
Quick Hits  |  3/20/2018  | 
Expedia announces a breach exposing 880,000 customer records to the world.
Facebook CISO Stamos to Depart from the Social Media Firm: Report
Quick Hits  |  3/20/2018  | 
Stamos will remain in his position through August, according to a report in The New York Times.
The Case for Integrating Physical Security & Cybersecurity
Commentary  |  3/20/2018  | 
Aggregating threat intel from external data sources is no longer enough. You must look inside and outside your traditional knowledge base for the best way to defend against attacks.
How to Access the Voter Information Dirt Cambridge Analytica Has on You
Dawn Kawamoto  |  3/20/2018  | 
UK-based Cambridge Analytica and its parent company are embroiled in controversy after amassing Facebook data on 270,000 users to influence election outcomes. Here's how to find out the dirt they have on you.
7 Spectre/Meltdown Symptoms That Might Be Under Your Radar
Slideshows  |  3/20/2018  | 
The Spectre/Meltdown pair has a set of major effects on computing but there are impacts on the organization that IT leaders might not have considered in the face of the immediate problem.
AI Is Stealing These IT Security Jobs Now
Dawn Kawamoto  |  3/20/2018  | 
Besides the current crop of jobs AI is stealing, other InfoSec roles are also potentially next unless professionals safeguard their careers by repositioning their skills, say IT security and careers experts.
AMD Processor Flaws Real, But Limited
News  |  3/19/2018  | 
A vulnerability report threatened falling skies over AMD processor vulnerabilities that are real but limited in impact.
New Method Proposed for Secure Government Access to Encrypted Data
News  |  3/19/2018  | 
'Crumple Zones' in crypto mechanisms can make it possible but astronomically expensive to access encrypted data, say researchers from Boston University and Portland State University.
Russian APT Compromised Cisco Router in Energy Sector Attacks
News  |  3/19/2018  | 
DragonFly hacking team that targeted US critical infrastructure compromised a network router as part of its attack campaign against UK energy firms last year.
Half of Cyberattacks in the Middle East Target Oil & Gas Sector: Siemens
Quick Hits  |  3/19/2018  | 
Nearly one-third of all cyberattacks worldwide are against operations technology (OT), or industrial networks, a new report by Siemens and The Ponemon Institute shows.
Microsoft Offers New Bug Bounties for Spectre, Meltdown-Type Flaws
Quick Hits  |  3/19/2018  | 
Microsoft is offering a short-term bug bounty program for speculative execution side-channel vulnerabilities and threats.
A Data Protection Officer's Guide to the GDPR Galaxy
Commentary  |  3/19/2018  | 
Impending deadline got you freaking out? These five tips might help you calm down, at least a little.
IoT Use Complicates Security Landscape in Healthcare
Simon Marshall  |  3/19/2018  | 
As billions of IoT devices are coming online, especially in healthcare, the security landscape is getting increasingly complicated, according to a report from Zingbox.
Fancy Bear Linked to DealersChoice Attacks in Europe
Larry Loeb  |  3/19/2018  | 
Researchers at Palo Alto Networks believe the Russia-linked Fancy Bear group is behind a new exploit called DealersChoice that is targeting European governments and agencies.
Cybercriminals Launder Up to $200B in Profit Per Year
News  |  3/19/2018  | 
Cybercrime funds make up 8-10% of all illegal profits laundered and amount to $80-200 billion each year.
Phantom Secure 'Uncrackable Phone' Execs Indicted for RICO Crimes
Quick Hits  |  3/16/2018  | 
Executives of Phantom Secure have been indicted on federal RICO charges for encrypting communications among criminals.
Who Does What in Cybersecurity at the C-Level
Slideshows  |  3/16/2018  | 
As security evolve as a corporate priority, so do the roles and responsibilities of the executive team. These seven titles are already feeling the impact.
Palo Alto Builds Automation, Compliance Muscle With $300M Evident.io Buy
News Analysis-Security Now  |  3/16/2018  | 
Palo Alto Networks expects to seal the deal to buy the five-year-old security startup by April 30.
Google Rolls Out New Security Features for Chrome Enterprise
Quick Hits  |  3/16/2018  | 
The business-friendly browser now includes new admin controls, EMM partnerships, and additions to help manage Active Directory.
FBI & DHS Accuse Russia of Hacking Critical Infrastructure
News Analysis-Security Now  |  3/16/2018  | 
In a report from US-CERT, the FBI and DHS accuse Russia of trying to hack critical US infrastructure, including nuclear power plants, using an array of attacks. The report follows additional sanctions against the country.
The Containerization of Artificial Intelligence
Commentary  |  3/16/2018  | 
AI automates repetitive tasks and alleviates mundane functions that often haunt decision makers. But it's still not a sure substitute for security best practices.
Government Workers Believe Security Is Someone Else's Job
Larry Loeb  |  3/16/2018  | 
A study from Dtex Systems finds a growing disconnect between government employees and the organizations that they work for over who is ultimately responsible for maintaining good security practices.
Are DDoS Attacks Increasing or Decreasing? Depends on Whom You Ask
News  |  3/15/2018  | 
Details on DDoS trends can vary, depending on the reporting source.
<<   <   Page 2 / 5   >   >>


News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22879
PUBLISHED: 2021-04-14
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
CVE-2021-27989
PUBLISHED: 2021-04-14
Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx.
CVE-2021-25316
PUBLISHED: 2021-04-14
A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions prior to 2.1.0-18.29.1. SUSE Linux Enterp...
CVE-2021-28797
PUBLISHED: 2021-04-14
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (an...
CVE-2020-36323
PUBLISHED: 2021-04-14
In the standard library in Rust before 1.50.3, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.