News & Commentary

Content tagged with Compliance posted in April 2013
Password Reuse Rampant, But Users Value Security, Survey Says
Quick Hits  |  4/30/2013  | 
More people adopt some online—and mobile—security, but still fail in proper follow-through, according to a new study by Varonis
Mobile AV Apps Fail To Detect Disguised Malware
News  |  4/29/2013  | 
Researchers test popular mobile antivirus apps on ability to detect repackaged, transformed versions of known Android malware
How Lockheed Martin Phishes Its Own
News  |  4/25/2013  | 
Defense contractor built an internal spearphishing simulation program amid concerns of increasing targeted attacks
Lawsuits Bring Clarity To SMBs In Corporate Account Takeovers
News  |  4/22/2013  | 
Small businesses have had millions of dollars stolen from their accounts by online thieves; court cases have started creating a clear picture of responsibilities
Scan My Eyeball, Already
Commentary  |  4/22/2013  | 
Could consumers be the catalyst for the password's ultimate demise?
Machine Learning Susses Out Social-Network Fraud
News  |  4/19/2013  | 
Machine-learning techniques can be used to detect fraud and spies on social networks based on certain features, such as the number of followers and devices used to access the network
Can We Cease Check-Box Compliance?
News  |  4/18/2013  | 
Some indicators show a transition to risk-based management driving security decisions, but compliance checklists still pay the infosec bills
Consumers Want Biometrics, Survey Finds
Quick Hits  |  4/18/2013  | 
New Ponemon Institute study shows disillusionment and problems with passwords in online transactions
Time To Dump Antivirus As Endpoint Protection?
News  |  4/18/2013  | 
Attackers find it easy to avoid signature- and heuristic-based anti-malware defenses. Experts recommend alternatives to antivirus programs be used alongside them, not in lieu of them
Coordinated Disclosure, Bug Bounties Help Speed Patches
News  |  4/17/2013  | 
Vulnerability advisories are increasingly accompanied by a patch these days, indicating that researchers and software firms are working more closely
Your Data Is Gone, Have A Nice Day
Commentary  |  4/16/2013  | 
Complete data loss and theft remain all too common
Researchers Analyze Brainwaves To Authenticate Users
News  |  4/12/2013  | 
Passwords may not need to be made of numbers and letters after all
Microsoft: 'Embassies' Could Provide Users Sanctuary From Threats
News  |  4/12/2013  | 
Taking a cue from virtualized datacenters, Microsoft researchers envision a browser architecture that isolates Web apps from each other to strengthen security
The Truth About Spam
Quick Hits  |  4/11/2013  | 
New study shows one in three spam emails contains malware-ridden attachments, and one-fourth of all bots are in enterprise networks
How Hackers Fool Your Employees
News  |  4/11/2013  | 
Attackers are taking aim at the weakest point in your network: human beings. Do you know how to protect your data?
Four Ways To Strengthen SMB Password Security
News  |  4/9/2013  | 
Ensuring that employees are abiding by good password policies is difficult, but there are simple ways to protect a business from workers who might choose 'password123'
Tools And Strategies For File-Level Data Protection
Quick Hits  |  4/7/2013  | 
Securing applications is helpful, but file-level protection can make data even more secure. Here's some advice on how to do it right
Google Uses Reputation To Detect Malicious Downloads
News  |  4/5/2013  | 
Researchers use data about websites, IP addresses, and domains to detect 99 percent of malicious executables downloaded by users -- outperforming antivirus and URL-reputation services
Hacking The User Security Awareness And Training Debate
News  |  4/4/2013  | 
Bruce Schneier says training end users on security is a waste of time. But security awareness experts argue there's a whole new generation and approach emerging that better schools users on security behaviors
Internal Audit Teams Target IT Security In 2013
News  |  4/4/2013  | 
IT risk management grows in importance amid other business-level enterprise risk management concerns
Carna Compromise Delivers Data, But Casts Suspicions
News  |  4/4/2013  | 
Created by an anonymous researcher, the Carna botnet found that 1.2 million Internet-connected devices are trivially exploitable, but the illegality of the methods raises doubts
Taming Bad Inputs Means Taking Aim At 'Weird Machines'
News  |  4/3/2013  | 
Overly accommodating platforms and protocols let attackers use inputs like code, essentially allowing attackers to program an unintentional virtual machine

Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
New 'Mac-A-Mal' Tool Automates Mac Malware Hunting & Analysis
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/14/2018
(ISC)2 Report: Glaring Disparity in Diversity for US Cybersecurity
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/15/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.