News & Commentary

Content tagged with Compliance posted in January 2012
Jury Still Out On Mobile Adware
News  |  1/31/2012  | 
Malicious software or not? Defining the threat on mobile platforms becomes more difficult as some advertising software enters a gray area
Big Data Could Create Compliance Issues
News  |  1/30/2012  | 
The bigger data sets grow, the harder compliance could become
Cloud Means More Secure Remote Access
News  |  1/30/2012  | 
Connecting hosts running remote-access services directly to the Internet is so last decade. Instead, companies look to move to cloud-enabled services or virtual desktop infrastructure.
The Mechanics Of Breach Notification
Commentary  |  1/27/2012  | 
Organizations need to know what constitutes a breach of identity data according to state laws and how to respond
The Future of Web Authentication
News  |  1/27/2012  | 
Many security experts believe the Internet's trust model is broken. Figuring out how to fix it will take time and collaboration
Smartcards: Still A Smart Choice?
News  |  1/26/2012  | 
Despite recent security compromises, smartcard technology still has high potential
Microsoft Names Alleged Botnet Operator Behind Kelihos
Quick Hits  |  1/24/2012  | 
Russian suspect worked for antivirus and software development firms in Russia
Breach Notification: Know The Rules
Commentary  |  1/20/2012  | 
State and federal laws require notification when a breach of protected information occurs. You need to know which laws apply and how to comply
Tilde-D Detection Focuses On Coding Anomalies
News  |  1/17/2012  | 
An open-source tool from the Laboratory of Cryptography and System Security hunts for Duqu using telltale signs left behind by the Tilde-D creation toolkit
Top 10 PCI Compliance Mistakes
News  |  1/16/2012  | 
Configuration mistakes, access control gaffes, and scoping issues top the list of common PCI errors
WISeKey And INSIDE Secure Join Forces To Target Counterfeit Luxury Goods
News  |  1/12/2012  | 
New solution also will offer sales monitoring and direct marketing capabilities
Identity Versus Authentication
Commentary  |  1/12/2012  | 
Distinguishing between identity and authentication
Comcast Internet Service Now Fully DNSSEC-Based
Quick Hits  |  1/10/2012  | 
ISP finishes its rollout of the DNS security protocol
Partner Management 3: How To Assess Prospective Partners
Commentary  |  1/7/2012  | 
Regulations require organizations to periodically assess security and compliance practices; the key is to understand how to do so effectively -- without breaking the bank
Three Surefire Ways To Tick Off An Auditor
News  |  1/3/2012  | 
Avoid these common mistakes to improve your chances for a smooth compliance audit


Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Microsoft Fixes 11 Critical, 39 Important Vulns
Kelly Sheridan, Staff Editor, Dark Reading,  6/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1060
PUBLISHED: 2018-06-18
python before versions 2.7.15, 3.4.9, 3.5.6 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
CVE-2018-1090
PUBLISHED: 2018-06-18
In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.
CVE-2018-1152
PUBLISHED: 2018-06-18
libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.
CVE-2018-1153
PUBLISHED: 2018-06-18
Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic.
CVE-2018-12530
PUBLISHED: 2018-06-18
An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF.