News & Commentary

Content tagged with Compliance posted in October 2011
Is Biometrics The Answer To The Authentication Question?
News  |  10/28/2011  | 
Years in the making, biometrics still has not entered the mainstream of authentication options. Here's a look at where and when to use it
Innovative Attacks Treat Mobile Phones As Sensors
News  |  10/27/2011  | 
Recent research showed that a phone's accelerometer could detect vibrations from key presses on a nearby keyboard
PCI Council Pegs Success On Community Involvement
News  |  10/27/2011  | 
The PCI Security Council celebrates its fifth anniversary this year with greater industry collaboration and more work ahead
Social Malice: One In 100 Tweets And One In 60 Facebook Posts Are Malicious
News  |  10/27/2011  | 
LinkedIn users feel safest, according to new social networking data gathered by Barracuda networks -- but not for long
Spam Gang Puts Up 80 URL-Shortening Service Sites
Quick Hits  |  10/25/2011  | 
Symantec discovers spammers leaving their own URL-shortening services open to the public
Compliance Holds Up Los Angeles Google Apps Deployment
News  |  10/24/2011  | 
Google Apps deployment has been long delayed due to security issues, but that doesn't mean security compliance is impossible with the cloud-based service
Pocket Guide To Securing Mobile Devices
News  |  10/24/2011  | 
With workers bringing their own smartphones and tablets into the company, IT security needs to focus on creating a more secure environment, not on securing each device
Sinkholing For Profit
Commentary  |  10/24/2011  | 
Concerns over the legality and ethics of security organizations that profit from their sinkhole operations
FFIEC Goes Beyond Traditional Authentication
Commentary  |  10/18/2011  | 
The FFIEC recommends that organizations provide additional business and fraud detection controls to offset weaknesses in authentication technology
Banking Trojans Adapting To Cheat Out-of-Band Security
News  |  10/18/2011  | 
As financial institutions adopt out-of-band security, attackers quickly adapt
New Microsoft Data Puts Zero-Day Threat Into Perspective
News  |  10/12/2011  | 
Report on infected Windows machines worldwide also highlights slack patching practices
Compliance Outside Corporate Walls
News  |  10/10/2011  | 
Getting third parties that touch regulated data to comply can be as important as your own internal compliance efforts
Users Whose Accounts Get Hacked Find Out From Their Friends
Quick Hits  |  10/6/2011  | 
New survey finds that 62 percent of users don't know how their Gmail, Yahoo, Hotmail, and Facebook accounts were hacked
ISP Backlash Over Feds' Bot Notification Initiative
News  |  10/5/2011  | 
MAAWG says ISPs are already tackling bots, and 'legislating' how to do it could stymie innovative efforts


WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17368
PUBLISHED: 2018-09-23
An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, which makes it easier to conduct brute-force attacks.
CVE-2018-17369
PUBLISHED: 2018-09-23
An issue was discovered in springboot_authority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter.
CVE-2018-17400
PUBLISHED: 2018-09-23
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by intercepting the user name and PIN during the initial configuration of the application.
CVE-2018-17401
PUBLISHED: 2018-09-23
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting its Forgot Password feature.
CVE-2018-17402
PUBLISHED: 2018-09-23
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiration date, and CVV number.