News & Commentary
Latest Content tagged with Database Security
|
Stop Building Silos. Security Is Everyone’s Problem
Yes, it’s true that the speed of DevOps has made security more difficult. But that doesn’t mean accelerated release cycles and secure applications have to be mutually exclusive.
Malware At Root Of Bangladesh Bank Heist Lies To SWIFT Financial Platform
Customized malware hid $81 million of wire transfers until the money had been safely laundered.
10 Tips for Securing Your SAP Implementation
Without clear ownership of security for a critical business platform like SAP, it should come as no surprise that SAP cybersecurity continues to fall through the cracks among IT, admin, security and InfoSec teams.
Databases Remain Soft Underbelly Of Cybersecurity
Most enterprises still don't continuously monitor database activity.
EU Privacy Officials Push Back On Privacy Shield
Better than Safe Harbor, but not good enough. Should we care what they think?
7 Lessons From The Panama Papers Leak
Hopefully your organization isn't hiding as many dark secrets as Mossack Fonseca, but the incident still brings helpful hints about data security, breach response, and breach impact.
Modern Web Apps: Not The Risk They Used To Be (They’re Worse!)
Even a tiny Web application without a single byte of confidential data can expose your corporate crown jewels to cybercriminals.
Survey: When Leaving Company, Most Insiders Take Data They Created
Most employees believe they own their work, and take strategy documents or intellectual property with them as they head out the door.
6 Critical SAP HANA Vulns Can't Be Fixed With Patches
Onapsis releases 21 SAP HANA security advisories, including some Trexnet vulnerabilities that require upgrades and reconfigurations.
15-Year-Old Arrested For TalkTalk Attack
U.K. police collar Northern Ireland youth for questioning, while security industry tries to make sense of confusing information out of TalkTalk CEO.
Another Healthcare Insurer, Excellus BCBS, Hit With Mega-Breach
Excellus Blue Cross Blue Shield and parent company Lifetime Healthcare Companies join ranks of Anthem and Premera after breach that may have exposed more than 10 million patient records.
Data Protection: The 98 Percent Versus The 2 Percent
Four steps for defending your most sensitive corporate information from the inside out.
How Ionic Says It Makes Data Breaches Irrelevant
Ionic Security goes public with a data security platform that manages trillions of encryption keys and enables a user to sign each pixel with its own unique key.
7 Bugs, Breaches, & Compromises To Rock 2015 (So Far)
The year's started off with a bang; will we hear risk management pros whimper?
Two More Health Insurers Report Data Breach
Premera Blue Cross and LifeWise say 11.25 million customers' records might have been exposed.
Cybercrime Dipped During Holiday Shopping Season
The number of businesses breached dropped by half from years past, but attackers got more bang for their buck in terms of stolen records, a new IBM report reveals.
JPMorgan Hack: 2FA MIA In Breached Server
Sources close to the breach investigation say a network server missing two-factor authentication let attackers make their way into JPMorgan's servers.
Data Management Vs. Data Loss Prevention: Vive La Différence!
A sensitive data management strategy can include the use of DLP technology, but it also involves a comprehensive understanding of where your data is and what specifically is at risk.
Don't Discount XSS Vulnerabilities
XSS flaws are more serious than you'd think.
Retailers Now Actively Sharing Cyberthreat Intelligence
The retail industry's R-CISC has been up and running for four months now and is looking for more retailers to sign up.
MBIA Breach Highlights Need For Tightened Security Ops
Configuration change management and better monitoring could have prevented search engine indexing of sensitive financial information.
Heartland CEO On Why Retailers Keep Getting Breached
Robert Carr, chairman and CEO of Heartland Payment Systems, says lack of end-to-end encryption and tokenization were factors in recent data breaches.
Backoff, Dairy Queen, UPS & Retail's Growing PoS Security Problem
Retail brands are trying to pass the buck for data security to banks and franchisees, say some experts.
Breach of Homeland Security Background Checks Raises Red Flags
"We should be burning down the house over this," says a GRC expert.
Heartbleed Not Only Reason For Health Systems Breach
Community Health Systems' bad patching practices are nothing compared to its poor encryption, network monitoring, fraud detection, and data segmentation, experts say.
Community Health Systems Breach Atypical For Chinese Hackers
Publicly traded healthcare organization's stock goes up as breach notifications go out.
Biggest Cache of Stolen Creds Ever Includes 1.2 Billion Unique Logins
A Russian crime ring has swiped more than a billion unique username-password combinations, plus a half-million email addresses.
Researcher Finds Flaws In Key Oracle Security Feature
Famed security researcher and Oracle database expert David Litchfield next month at Black Hat USA will present details of weaknesses he discovered in a widely touted new security feature in Oracle databases.
Dark Reading Radio: Oracle Database Security Hacked
Learn about newly found vulnerabilities in a key database security feature tomorrow in the next episode of Dark Reading Radio.
The Only 2 Things Every Developer Needs To Know About Injection
There’s no simple solution for preventing injection attacks. There are effective strategies that can stop them in their tracks.
Into The Breach: The Limits Of Data Security Technology
When it comes to cyberdefense spending, the smart money should bet on people and compliance as much as on machines.
Privacy, Cybercrime Headline the Infosecurity Europe Conference
Attendees debate NSA surveillance, privacy reforms, cybercrime defenses, and sharpen their CISO skills.
Michaels Retail Chain Reveals Details Of Breach: Nearly 3M Affected
Attack on point-of-sale systems went on for more than six months, officials say.
SQL Injection Cleanup Takes Two Months or More
A new report highlights the prevalence and persistence of SQL injection attacks.
Attackers Hit Clearinghouse Selling Stolen Target Data
Hackers interrupt and deface sites of black-market forums selling credit card data stolen from Target and other retailers.
7 Behaviors That Could Indicate A Security Breach
Breaches create outliers. Identifying anomalous activity can help keep firms in compliance and out of the headlines.
The Case For Browser-Based Access Controls
Is "browser-ized" security a better defense against hackers than traditional methods? Check out these two examples.
FIDO Alliance Releases Authentication Standards, Unveils Products
Proponents say the new specifications will pave the way for the replacement of passwords, which are frequently lost, stolen, or hacked.
Target Breach: Phishing Attack Implicated
Report suggests malware-laced email attack on Target's HVAC subcontractor leaked access credentials for retailer's network.
Data Breach Notifications: Time For Tough Love
Target and Neiman Marcus came clean quickly about their data breaches, but most business don't. It's time for standards -- and fines.
4 Hurdles That Trip Security Analytics Efforts
Don't let these people and process problems get in the way of security analytics effectiveness.
Target Mocks, Not Helps, Its Data Breach Victims
The only thing consumers did wrong is to shop at Target. Why are they being blamed for the retailer's security failings?
HIPAA, SOX & PCI: The Coming Compliance Crisis In IT Security
New mandates around datacenter virtualization, enterprise apps, and BYOD will stretch IT security staffs and budgets to the max in 2014.
Target Breach: 8 Facts On Memory-Scraping Malware
Target confirmed that malware compromised its point-of-sale systems. How does such malware work, and how can businesses prevent infections?
Cloud Gazing: 3 Security Trends To Watch
The ultimate success of cloud computing depends on the security solutions we wrap around it.
Security, Privacy & The Democratization Of Data
Data gathering and profiling capabilities that today are only available to nation states will eventually be at the disposal of everyone. What then?
|
White Papers
Video
3 Comments
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I spy, you spy, we all spy...a spy...
Latest Comment: I spy, you spy, we all spy...a spy...
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2018-19367
PUBLISHED: 2018-11-20
PUBLISHED: 2018-11-20
PUBLISHED: 2018-11-20
PUBLISHED: 2018-11-20
PUBLISHED: 2018-11-19
From DHS/US-CERT's National Vulnerability Database CVE-2018-19367
PUBLISHED: 2018-11-20
Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case.
CVE-2018-19335PUBLISHED: 2018-11-20
Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-19334PUBLISHED: 2018-11-20
Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-10099PUBLISHED: 2018-11-20
Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-17906PUBLISHED: 2018-11-19
Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2018 UBM, All rights reserved
Tweet This