Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
|
Post-Heartbleed: When Not To Change Your Password
One takeaway from Heartbleed is that conventional wisdom about the need to periodically change passwords is wrong.
AOL Subscriber Data Stolen: You've Got Pwned
Change passwords and security questions now, AOL warns subscribers. For everyone else, treat all emails from AOL addresses with suspicion.
Mobile & Social: The Tipping Point For Cybercrime
Spamming and scamming has moved to social media in full force, according to new research on the Twittersphere from Trend Micro.
Microsoft Warns Of Zero-Day Vulnerability In Internet Explorer
Zero-day security vulnerability in IE 6-11 could allow remote code execution even if the user doesn't click on anything, Microsoft says.
Organized Crime Group Scams US Companies Out Of Millions
Social engineering attack tricks companies into large wire transfers.
Why Bug Bounties Are The New Normal
Bug bounties today are big business. Find out how crowdsourcing is changing the dynamics of independent security research and vulnerability disclosure.
After Heartbleed, Tech Giants Fund Open Source Security
In the wake of the Heartbleed vulnerability, 12 tech giants -- including Facebook, Google, IBM, and Microsoft -- each pledge $100,000 annually to improve core open source technology such as OpenSSL.
Data Security: Think Outside The Box
What the public and private sector can learn from each other's data security priorities is an exercise in nuance that is well worth the effort. Here's why.
Android Heartbleed Alert: 150 Million Apps Still Vulnerable
Android developers are starting to patch OpenSSL flaws. Meanwhile, Apple ships an SSL fix for iOS and OS X.
Workplace Data Privacy Vs. Security: The New Balance
Is it time to rethink the traditional lock-down approach to employee use of corporate networks at work?
7 Tips To Improve 'Signal-to-Noise' In The SOC
When security analysts are desensitized to alerts because of sheer volume, they miss the true positives that can prevent a large-scale data breach. Here's how to up your game.
Free Scanning Tool Promises To Find Heartbleed On Any Device
CrowdStrike says tool identifies the flaw on web servers, VPNs, servers, routers, printers, and phones.
Stolen Passwords Used In Most Data Breaches
New Verizon 2014 Data Breach Investigations Report identifies nine types of attack patterns that accounted for 93 percent of security incidents in the past decade.
FAQ: Understanding The True Price of Encryption
In the wake of recent events like Heartbleed, the search for cost-effective, easy, and scalable encryption solutions has never been more important.
Heartbleed Attack Targeted Enterprise VPN
Attack spotted using the OpenSSL Heartbleed bug to steal session tokens and bypass two-factor authentication.
Michaels Retail Chain Reveals Details Of Breach: Nearly 3M Affected
Attack on point-of-sale systems went on for more than six months, officials say.
Poll: Dark Reading Community Acts On Heartbleed
Roughly 60 percent of respondents to our flash poll have installed the Heartbeat fix or are in the process of doing so.
Satellite Communications Wide Open To Hackers
Satellite terminals widely used in transportation, military, and industrial plants contain backdoors, hardcoded credentials, weak encryption algorithms, and other design flaws, a new report says.
11 Heartbleed Facts: Vulnerability Discovery, Mitigation Continue
Millions of websites, applications from Cisco and VMware, Google Play apps, as well as millions of Android devices are vulnerable -- and the list keeps growing.
How A Little Obscurity Can Bolster Security
Most security professionals deride the idea of "security by obscurity." Is it time to re-evaluate the conventional wisdom?
Did A Faulty Memory Feature Lead To Heartbleed?
Debate arises over an older memory allocation feature in OpenSSL, and the OpenBSD community starts to tear down and revise the crypto software for its own use.
Mobility: Who Bears The Brunt Of Data Security & Privacy
OS manufacturers, app developers, and consumers all have a role to play in smartphone data security. But not everyone is equally responsible.
White House Details Zero-Day Bug Policy
NSA denies prior knowledge of the Heartbleed vulnerability, but the White House reserves the right to withhold zero-day exploit information in some cases involving security or law enforcement.
CIO Vs. CSO: Allies Or Enemies?
In the wake of the Target breach it's clear that the CIO and CSO must have clear boundaries of responsibility and equal representation in the board room.
'Baby Teeth' In Infrastructure Cyber Security Framework
NIST’s modest effort to improve lax security around IT infrastructure in airports, utilities, and other critical areas now heads to Congress. Don't hold your breath.
Free Heartbleed-Checker Released for Firefox Browser
Browser plug-ins arrive for Firefox and Chrome that scan websites for Heartbleed risk
Heartbleed Will Go On Even After The Updates
What's next now that the mindset is 'assume the worst has already occurred?'
Flash Poll: Broken Heartbeat
What steps do you plan to take in response to the Heartbleed bug? Take our poll and share your reasons in the comments.
Heartbleed: Examining The Impact
With Heartbleed, there’s little hope of knowing if an asset was breached, if a breach can be identified, or what, if any, data was leaked. Here’s how to defend against future attacks.
More Than A Half-Million Servers Exposed To Heartbleed Flaw
What the newly exposed SSL/TLS threat really means for enterprises and end-users.
What’s Worse: Credit Card Or Identity Theft?
When it comes to data loss, it’s time for the conversation to shift from credit cards to personal information like Social Security numbers, home addresses, and your favorite flavor of ice cream.
Emergency SSL/TLS Patching Under Way
A "Heartbleed" flaw revealed in the OpenSSL library leaks the contents of memory, including passwords, source code, and keys.
One Year Later: The APT1 Report
One of the most positive impacts of APT1 is the undeniable rise in the stature of the threat intelligence industry. "Threat Intelligence" is the SIEM, the NAC of 2014.
Social Engineering Grows Up
Fifth annual DEF CON Social Engineering Capture the Flag Contest kicks off today with new "tag team" rules to reflect realities of the threat.
If Mother Nature Were A CISO
There are many defensive patterns in nature that also apply to information security. Here's how to defeat your predators in the high-stakes game of corporate survival and resiliency.
Advanced Attacks Are The New Norm, Study Says
According to the Websense 2014 Threat Report, most malicious exploits now are advanced and targeted.
Nominum: 24 Million Home Routers Exposing ISPs to DDoS Attacks
Even Internet service providers that go to great lengths to protect their networks are vulnerable.
NSA’s Big Surprise: Gov’t Agency Is Actually Doing Its Job
When people claimed after 9/11 that the NSA was ill equipped to deal with a changing world, I wonder what they expected to happen.
API-First: 3 Steps For Building Secure Cloud Apps
When it comes to protecting data traveling to and from the cloud, today's choices are daunting. Here are three steps for making the application programming interface your new best friend.
The Right Stuff: Staffing Your Corporate SOC
What makes a top-notch security analyst? Passion, experience, and communication skills trump certifications and degrees. But you get what you pay for.
Cyber Criminals Operate On A Budget, Too
New report shines light on how attacks have gotten more advanced but still basically use some of the same old, same old, tools
Be Careful Beating Up Target
Target was actually better prepared than most retailers. The real problem lies with the current state of industry threat intelligence and IR practices.
|
Latest Comment: "Looks like the Trojans are evolving into a more focused attack mode."
Navigating the Deluge of Security DataIn this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industry’s conventional wisdom. Here’s a look at what they’re thinking about.
Tweet This
1 Comments
