News & Commentary

Companies need to take a centralized approach to protecting confidential data and assets. Here are 12 ways to get a handle on the problem.

Who Are You, Really? A Peek at the Future of Identity

News | 12/14/2018 |

Experts dive into the trends and challenges defining the identity space and predict how online identities will change in years to come.

Insider Threats & Insider Objections

Commentary | 12/7/2018 |

The ‘tyranny of the urgent’ and three other reasons why it’s hard for CISOs to establish a robust insider threat prevention program.

Republican Committee Email Hacked During Midterms

Quick Hits | 12/5/2018 |

The National Republican Congressional Committee detected the compromise of four staffers' email accounts in April.

6 Ways to Strengthen Your GDPR Compliance Efforts

Slideshows | 12/5/2018 |

Companies have some mistaken notions about how to comply with the new data protection and privacy regulation – and that could cost them.

Microsoft, Mastercard Aim to Change Identity Management

News | 12/3/2018 |

7 comments

A new partnership wants to improve how people use and manage the virtual identities that govern their lives online.

The Return of Email Flooding

Commentary | 11/29/2018 |

5 comments

An old attack technique is making its way back into the mainstream with an onslaught of messages that legacy tools and script writing can't easily detect.

8 Tips for Preventing Credential Theft Attacks on Critical Infrastructure

Commentary | 11/27/2018 |

Stolen credentials for industrial control system workstations are fast becoming the modus operandi for ICS attacks by cybercriminals.

Empathy: The Next Killer App for Cybersecurity?

Commentary | 11/13/2018 |

3 comments

The toughest security problems involve people not technology. Here's how to motivate your frontline employees all the way from the service desk to the corner office.

Why Password Management and Security Strategies Fall Short

News | 11/7/2018 |

Researchers say companies need to rethink their password training and take a more holistic approach to security.

Where Is the Consumer Outrage about Data Breaches?

Commentary | 11/1/2018 |

4 comments

Facebook, Equifax, Cambridge Analytica … Why do breaches of incomprehensible magnitude lead to a quick recovery for the businesses that lost or abused the data and such little lasting impact for the people whose information is stolen.

Companies Fall Short on 2FA

Quick Hits | 10/30/2018 |

New research ranks organizations based on whether they offer two-factor authentication.

The Case for MarDevSecOps

Commentary | 10/30/2018 |

11 comments

Why security must lead the integration of marketing into the collaborative security and development model in the cloud.

Securing Serverless: Attacking an AWS Account via a Lambda Function

Commentary | 10/25/2018 |

It’s not every day that someone lets you freely wreak havoc on their account just to find out what happens when you do.

Risky Business: Dark Reading Caption Contest Winners

Commentary | 10/19/2018 |

Phishing, anti-shoulder surfing, Russia and other hysterical identity management puns and comments. And the winners are ...

4 Ways to Fight the Email Security Threat

Commentary | 10/15/2018 |

It's time to reimagine employee training with fresh, more aggressive approaches that better treat email security as a fundamentally human problem.

Google Adds New Identity, Security Tools to Cloud Platform

News | 10/11/2018 |

A wave of cloud news includes new tools for identity and access management and policies for stronger controls on cloud resources.

Lessons Learned from the Facebook Breach: Why Logic Errors Are So Hard to Catch

Commentary | 10/9/2018 |

By ensuring that each layer of protection scours an application for unintended uses, you can find the flaws before the bad guys do.

Who Do You Trust? Parsing the Issues of Privacy, Transparency & Control

Commentary | 10/5/2018 |

Technology such as Apple's device trust score that decides "you" is “not you” is a good thing. But only if it works well.

How Data Security Improves When You Engage Employees in the Process

Commentary | 9/28/2018 |

6 comments

When it comes to protecting information, we can all do better. But encouraging a can-do attitude goes a long way toward discouraging users' risky behaviors.

The Cloud Security Conundrum: Assets vs. Infrastructure

Commentary | 9/25/2018 |

The issue for cloud adopters is no longer where your data sits in AWS, on-premises, Azure, Salesforce, or what have you. The important questions are: Who has access to it, and how is it protected?

6 Security Training Hacks to Increase Cyber IQ Org-Wide

Slideshows | 9/21/2018 |

Move beyond generic, annual security awareness training with these important tips.

Turn the NIST Cybersecurity Framework into Reality: 5 Steps

Commentary | 9/20/2018 |

6 comments

Actionable advice for tailoring the National Institute of Standards and Technology's security road map to your company's business needs.

WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication

Commentary | 9/19/2018 |

5 comments

New standards offer protection against hacking, credential theft, phishing attacks, and hope for the end of an era of passwords as a security construct.

The Top 5 Security Threats & Mitigations for Industrial Networks

Commentary | 9/18/2018 |

While vastly different than their IT counterparts, operational technology environments share common risks and best practices.

New Study Details Business Benefits of Biometrics

Quick Hits | 9/12/2018 |

Biometric authentication can be good for security and for business, according to a new study from Goode Intelligence

Machine Identities Need Protection, Too

Quick Hits | 8/31/2018 |

A new study shows that device identities need a level of protection that they're not getting from most organizations.

4 Benefits of a World with Less Privacy

Commentary | 8/30/2018 |

5 comments

The privacy issue is a problem for a lot of people. I see it differently.

How One Company’s Cybersecurity Problem Becomes Another's Fraud Problem

Commentary | 8/29/2018 |

8 comments

The solution: When security teams see something in cyberspace, they need to say something.

A False Sense of Security

Commentary | 8/24/2018 |

Emerging threats over the next two years stem from biometrics, regulations, and insiders.

The Votes Are In: Election Security Matters

Commentary | 8/22/2018 |

Three ways to make sure that Election Day tallies are true.

How to Gauge the Effectiveness of Security Awareness Programs

Commentary | 8/21/2018 |

If you spend $10,000 on an awareness program and expect it to completely stop tens of millions of dollars in losses, you are a fool. If $10,000 prevents $100,000 in loss, that's a 10-fold ROI.

Make a Wish: Dark Reading Caption Contest Winners

Commentary | 8/18/2018 |

Certification, endpoint security, 2FA, phishing, and PII were among the themes and puns offered by readers in our latest cartoon caption competition. And the winners are ...

The 5 Challenges of Detecting Fileless Malware Attacks

Commentary | 8/17/2018 |

Simply applying file-based tools and expectations to fileless attacks is a losing strategy. Security teams must also understand the underlying distinctions between the two.

Shadow IT: Every Company's 3 Hidden Security Risks

Commentary | 8/7/2018 |

Companies can squash the proliferation of shadow IT if they listen to employees, create transparent guidelines, and encourage an open discussion about the balance between security and productivity.

How GDPR Could Turn Privileged Insiders into Bribery Targets

Commentary | 8/2/2018 |

Regulatory penalties that exceed the cost of an extortion payout may lead to a new form of ransomware. These four steps can keep you from falling into that trap.

Every Week Is Shark Week in Cyberspace

Commentary | 7/27/2018 |

7 comments

Your data, identities, and credentials are cyber chum. Here's how to protect yourself from the feeding frenzy.

London Calling with New Strategies to Stop Ransomware

Commentary | 7/23/2018 |

The new London Protocol from the Certificate Authority Security Council/Browser Forum aims to minimize the possibility of phishing activity on high-value identity websites.

The Fundamental Flaw in Security Awareness Programs

Commentary | 7/19/2018 |

4 comments

It's a ridiculous business decision to rely on the discretion of a minimally trained user to thwart a highly skilled sociopath, financially motivated criminal, or nation-state.

Beyond Passwords: Why Your Company Should Rethink Authentication

Commentary | 7/19/2018 |

Scaling security infrastructure requires scaling trust of users, devices, and methods of authentication. Here's how to get started.

India Telecom Regulator: Users Have Primary Data Rights

Quick Hits | 7/16/2018 |

Organizations 'should be restrained from using metadata to identify individual users,' says the Telecom Regulatory Authority of India.

Reactive or Proactive? Making the Case for New Kill Chains

Commentary | 7/6/2018 |

Classic kill chain models that aim to find and stop external attacks don't account for threats from insiders. Here what a modern kill chain should include.

White House Email Security Faux Pas?

Commentary | 6/22/2018 |

The Executive Office of the President isn't complying with the DMARC protocol, but that has fewer implications than some headlines would suggest.

Inside a SamSam Ransomware Attack

Commentary | 6/20/2018 |

Here's how hackers use network tools and stolen identities to turn a device-level compromise into an enterprise-level takedown.

3 Tips for Driving User Buy-in to Security Policies

Commentary | 6/18/2018 |

Teaching users why it's important to commit to security controls is a far more effective strategy than simply demanding that they follow them. Here's how.

Dark Reading Launches Second INsecurity Conference

News | 6/5/2018 |

To be held in Chicago Oct. 23-25, defense-focused conference will feature closed-door discussions, co-resident Black Hat Training sessions

Fortinet Completes Bradford Networks Purchase

Quick Hits | 6/4/2018 |

NAC and security firm added to Fortinet's portfolio.

5 Tips for Protecting SOHO Routers Against the VPNFilter Malware

Slideshows | 6/2/2018 |

3 comments

Most home office users need to simply power cycle their routers and disable remote access; enterprises with work-at-home employees should move NAS behind the firewall.

The Good News about Cross-Domain Identity Management

Commentary | 5/31/2018 |

Adoption of the SCIM open source, standards-based approach for syncing user information between applications is ratcheting up among SaaS vendors as well as enterprises.

Facebook Must Patch 2 Billion Human Vulnerabilities; How You Can Patch Yours

Commentary | 5/31/2018 |