News & Commentary

Content tagged with Compliance posted in October 2012
ZeroAccess Botnet Surges
Quick Hits  |  10/30/2012  | 
2.2 million infected with fraudulent ad-click botnet's malware, new report finds
Five Habits Of Companies That Catch Insiders
News  |  10/22/2012  | 
A survey of 40 companies that have successfully dealt with insider threats shows that the solution is less technology and more psychology
Zero-Day Attacks Long-Lived, Presage Mass Exploitation
News  |  10/18/2012  | 
Zero-day attacks escape detection for an average of 10 months; once they go public, attacks multiply dramatically, researchers find
Microsoft Hands Off Nitol Botnet Sinkhole Operation To Chinese CERT
Quick Hits  |  10/2/2012  | 
Notorious 3322.org domain operator has agreed to cooperate with Microsoft and Chinese Computer Emergency Response Team to block malicious traffic, malware, in the domain
Leaked Account Notification May Be Worth The Warning
News  |  10/2/2012  | 
PwnedList provides companies and consumers with warnings of any account names that have been leaked to the public. Such services can help firms find out when an account could be in jeopardy, but coverage remains spotty
Compliance: The Boring Adult At The Security Party
Commentary  |  10/1/2012  | 
Compliance and security are not the same thing


WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8023
PUBLISHED: 2018-09-21
Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timin...
CVE-2018-14643
PUBLISHED: 2018-09-21
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
CVE-2018-14645
PUBLISHED: 2018-09-21
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.
CVE-2018-1685
PUBLISHED: 2018-09-21
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability in db2cacpy that could allow a local user to read any file on the system. IBM X-Force ID: 145502.
CVE-2018-1710
PUBLISHED: 2018-09-21
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 tool db2licm is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 146364.