Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Compliance posted in April 2013
Password Reuse Rampant, But Users Value Security, Survey Says
Quick Hits  |  4/30/2013  | 
More people adopt some online—and mobile—security, but still fail in proper follow-through, according to a new study by Varonis
Mobile AV Apps Fail To Detect Disguised Malware
News  |  4/29/2013  | 
Researchers test popular mobile antivirus apps on ability to detect repackaged, transformed versions of known Android malware
How Lockheed Martin Phishes Its Own
News  |  4/25/2013  | 
Defense contractor built an internal spearphishing simulation program amid concerns of increasing targeted attacks
Lawsuits Bring Clarity To SMBs In Corporate Account Takeovers
News  |  4/22/2013  | 
Small businesses have had millions of dollars stolen from their accounts by online thieves; court cases have started creating a clear picture of responsibilities
Scan My Eyeball, Already
Commentary  |  4/22/2013  | 
Could consumers be the catalyst for the password's ultimate demise?
Machine Learning Susses Out Social-Network Fraud
News  |  4/19/2013  | 
Machine-learning techniques can be used to detect fraud and spies on social networks based on certain features, such as the number of followers and devices used to access the network
Can We Cease Check-Box Compliance?
News  |  4/18/2013  | 
Some indicators show a transition to risk-based management driving security decisions, but compliance checklists still pay the infosec bills
Consumers Want Biometrics, Survey Finds
Quick Hits  |  4/18/2013  | 
New Ponemon Institute study shows disillusionment and problems with passwords in online transactions
Time To Dump Antivirus As Endpoint Protection?
News  |  4/18/2013  | 
Attackers find it easy to avoid signature- and heuristic-based anti-malware defenses. Experts recommend alternatives to antivirus programs be used alongside them, not in lieu of them
Coordinated Disclosure, Bug Bounties Help Speed Patches
News  |  4/17/2013  | 
Vulnerability advisories are increasingly accompanied by a patch these days, indicating that researchers and software firms are working more closely
Your Data Is Gone, Have A Nice Day
Commentary  |  4/16/2013  | 
Complete data loss and theft remain all too common
Researchers Analyze Brainwaves To Authenticate Users
News  |  4/12/2013  | 
Passwords may not need to be made of numbers and letters after all
Microsoft: 'Embassies' Could Provide Users Sanctuary From Threats
News  |  4/12/2013  | 
Taking a cue from virtualized datacenters, Microsoft researchers envision a browser architecture that isolates Web apps from each other to strengthen security
The Truth About Spam
Quick Hits  |  4/11/2013  | 
New study shows one in three spam emails contains malware-ridden attachments, and one-fourth of all bots are in enterprise networks
How Hackers Fool Your Employees
News  |  4/11/2013  | 
Attackers are taking aim at the weakest point in your network: human beings. Do you know how to protect your data?
Four Ways To Strengthen SMB Password Security
News  |  4/9/2013  | 
Ensuring that employees are abiding by good password policies is difficult, but there are simple ways to protect a business from workers who might choose 'password123'
Tools And Strategies For File-Level Data Protection
Quick Hits  |  4/7/2013  | 
Securing applications is helpful, but file-level protection can make data even more secure. Here's some advice on how to do it right
Google Uses Reputation To Detect Malicious Downloads
News  |  4/5/2013  | 
Researchers use data about websites, IP addresses, and domains to detect 99 percent of malicious executables downloaded by users -- outperforming antivirus and URL-reputation services
Hacking The User Security Awareness And Training Debate
News  |  4/4/2013  | 
Bruce Schneier says training end users on security is a waste of time. But security awareness experts argue there's a whole new generation and approach emerging that better schools users on security behaviors
Internal Audit Teams Target IT Security In 2013
News  |  4/4/2013  | 
IT risk management grows in importance amid other business-level enterprise risk management concerns
Carna Compromise Delivers Data, But Casts Suspicions
News  |  4/4/2013  | 
Created by an anonymous researcher, the Carna botnet found that 1.2 million Internet-connected devices are trivially exploitable, but the illegality of the methods raises doubts
Taming Bad Inputs Means Taking Aim At 'Weird Machines'
News  |  4/3/2013  | 
Overly accommodating platforms and protocols let attackers use inputs like code, essentially allowing attackers to program an unintentional virtual machine


Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
CVE-2020-17532
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd