Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Commentary

Latest Content
Page 1 / 2   >   >>
On International Women's Day 2021, Does the 'Rule of Steve' Still Apply? Yes.
Commentary  |  3/5/2021  | 
On International Women's Day 2021, gender diversity has improved in cybersecurity, but there is still a long way to go.
Make Sure That Stimulus Check Lands in the Right Bank Account
Commentary  |  3/5/2021  | 
If you haven't already, it's time to build trust relationships with your financial institutions, using strong security, privacy protections and secure, unique user credentials.
Secure Laptops & the Enterprise of the Future
Commentary  |  3/4/2021  | 
The enterprise of the future will depend upon organizations' ability to extend the company firewall to everywhere people are working.
Why We Need More Blue Team Voices at the Table
Commentary  |  3/4/2021  | 
The red team draws attention, but the blue team has the expertise to keep networks secure day in and day out.
How SolarWinds Busted Up Our Assumptions About Code Signing
Commentary  |  3/3/2021  | 
With so much automation in code writing process, results are rarely double-checked, which opens the door to vulnerabilities and downright danger.
Design, Security, Tech Is the New Stack You Should Be Building
Commentary  |  3/3/2021  | 
Instead of different departments managing information systems, Ally Financial has combined data, digitization, security, and design into a single "stack" of human resources.
4 Ways Health Centers Can Stop the Spread of Cyberattacks
Commentary  |  3/2/2021  | 
Health centers must shift the perception of cyberattacks from potential risk to real threat in order to take the first step toward a safer, healthier security posture.
Why Cloud Security Risks Have Shifted to Identities and Entitlements
Commentary  |  3/2/2021  | 
Traditional security tools focus on the network perimeter, leaving user and service accounts vulnerable to hackers.
Building a Next-Generation SOC Starts With Holistic Operations
Commentary  |  3/1/2021  | 
The proper template for a modernized SOC team is one that operates seamlessly across domains with a singular, end-to-end view.
After a Year of Quantum Advances, the Time to Protect Is Now
Commentary  |  2/26/2021  | 
Innovations in quantum computing mean enterprise and manufacturing organizations need to start planning now to defend against new types of cybersecurity threats.
5 Key Steps Schools Can Take to Defend Against Cyber Threats
Commentary  |  2/25/2021  | 
Educational institutions have become prime targets, but there are things they can do to stay safer.
How to Avoid Falling Victim to a SolarWinds-Style Attack
Commentary  |  2/25/2021  | 
A multilayered, zero-trust security posture provides a better chance of fending off sophisticated supply chain attackers before it's too late.
The Realities of Extended Detection and Response (XDR) Technology
Commentary  |  2/24/2021  | 
While the term XDR has become pervasive, the technology and market remain a work in progress with lots of innovation and market confusion.
3 Security Flaws in Smart Devices & IoT That Need Fixing
Commentary  |  2/24/2021  | 
The scope and danger of unsecured, Internet-connected hardware will only continue to deepen.
Augmenting SMB Defense Strategies With MITRE ATT&CK: A Primer
Commentary  |  2/23/2021  | 
Any organization can use MITRE ATT&CK as a force multiplier, but it's especially valuable for small ones.
CVSS as a Framework, Not a Score
Commentary  |  2/23/2021  | 
The venerable system has served us well but is now outdated. Not that it's time to throw the system away; use it as a framework to measure risk using modern, context-based methods.
What Can Your Connected Car Reveal About You?
Commentary  |  2/22/2021  | 
App developers must take responsibility for the security of users' data.
How to Fine-Tune Vendor Risk Management in a Virtual World
Commentary  |  2/19/2021  | 
Without on-site audits, many organizations lack their usual visibility to assess risk factors and validate contracts and SLA with providers.
Hiding in Plain Sight: What the SolarWinds Attack Revealed About Efficacy
Commentary  |  2/18/2021  | 
Multilayered infiltration involved custom malicious tooling, backdoors, and cloaked code, far beyond the skills of script kiddies.
Data Security Accountability in an Age of Regular Breaches
Commentary  |  2/18/2021  | 
As the number of vendors impacted by supply chain breaches grows, one constant question remains: Where exactly does accountability for data security lie, and what part do end users play in their own data breach protection?
Virginia Takes Different Tack Than California With Data Privacy Law
Commentary  |  2/18/2021  | 
Online businesses targeting Virginia consumers and have personal data of 100,000 consumers in the state must conform to the new statute.
Ransomware? Let's Call It What It Really Is: Extortionware
Commentary  |  2/17/2021  | 
Just as the targets of these attacks have shifted from individuals to corporations, so too has the narrow focus given way to applying force and pressure to pay.
4 Predictions for the Future of Privacy
Commentary  |  2/17/2021  | 
Use these predictions to avoid pushback, find opportunity, and create value for your organization.
Under Attack: Hosting & Internet Service Providers
Commentary  |  2/16/2021  | 
The digital universe depends on always-on IT networks and services, so ISPs and hosting providers have become favorite targets for cyberattacks.
Black History Month 2021: Time to Talk Diversity and Cybersecurity
Commentary  |  2/16/2021  | 
In an industry that consistently needs new ideas, it's essential to have individuals who think, speak, and act in diverse ways.
Malware Exploits Security Teams' Greatest Weakness: Poor Relationships With Employees
Commentary  |  2/15/2021  | 
Users' distrust of corporate security teams is exposing businesses to unnecessary vulnerabilities.
How to Submit a Column to Dark Reading
Commentary  |  2/15/2021  | 
Have a new idea, a lesson learned, or a call to action for your fellow cybersecurity professionals? Here's how to submit your Commentary pieces to Dark Reading.
You've Got Cloud Security All Wrong: Managing Identity in a Cloud World
Commentary  |  2/12/2021  | 
In a hybrid and multicloud world, identity is the new perimeter and a critical attack surface for bad actors.
Game Over: Stopping DDoS Attacks Before They Start
Commentary  |  2/11/2021  | 
Video games are poised for a revolution, but benefits will come to fruition only if the industry can guarantee consistent performance and availability.
Cloud-Native Apps Make Software Supply Chain Security More Important Than Ever
Commentary  |  2/11/2021  | 
Cloud-native deployments tend to be small, interchangeable, and easier to protect, but their software supply chains require closer attention.
Zero Trust in the Real World
Commentary  |  2/10/2021  | 
Those who are committed to adopting the concept have the opportunity to make a larger business case for it across the organization, working with executive leaders to implement a zero-trust framework across the entire enterprise.
Multivector Attacks Demand Security Controls at the Messaging Level
Commentary  |  2/10/2021  | 
As a Google-identified attack reveals, security teams need to look beyond VPNs and network infrastructure to the channels where social engineering takes place.
How Neurodiversity Can Strengthen Cybersecurity Defense
Commentary  |  2/9/2021  | 
Team members from different backgrounds, genders, ethnicities, and neurological abilities are best equipped to tackle today's security challenges.
SolarWinds Attack Reinforces Importance of Principle of Least Privilege
Commentary  |  2/9/2021  | 
Taking stock of least-privilege policies will go a long way toward hardening an organization's overall security posture.
Hidden Dangers of Microsoft 365's Power Automate and eDiscovery Tools
Commentary  |  2/8/2021  | 
Attackers are using legitimate enterprise tools to execute attacks and carry out malicious actions. Security teams must take action now.
Cartoon Caption Winner: Insider Threat
Commentary  |  2/8/2021  | 
And the winner of Dark Reading's January cartoon caption contest is ...
Cybercrime Goes Mainstream
Commentary  |  2/5/2021  | 
Organized cybercrime is global in scale and the second-greatest risk over the next decade.
Is $50,000 for a Vulnerability Too Much?
Commentary  |  2/4/2021  | 
Lofty bug bounties catch attention, but don't alleviate the application security flaws they are trying to solve.
An Observability Pipeline Could Save Your SecOps Team
Commentary  |  2/3/2021  | 
Traditional monitoring approaches are proving brittle as security operations teams need better visibility into dynamic environments.
Security in a Complex World
Commentary  |  2/3/2021  | 
Innovation and complexity can co-exist; the key is to use innovation to make ever-expanding complexity comprehensible and its effects predictable.
RF Enables Takeover of Hostile Drones
Commentary  |  2/2/2021  | 
Tempting as it may be to blast drones out of the sky, a less aggressive approach may yield better data about attackers and keep bystanders safe.
How Recruiting Women Can Help Solve Security's Biggest Problems
Commentary  |  2/2/2021  | 
We can solve cybersecurity's longstanding talent gap by bringing more women into the field.
Strengthening Zero-Trust Architecture
Commentary  |  2/1/2021  | 
Organizations that want to stay ahead of cybercriminals will find that going beyond user trust and device trust is critical for outwitting their adversaries.
Is the Web Supply Chain Next in Line for State-Sponsored Attacks?
Commentary  |  1/29/2021  | 
Attackers go after the weak links first, and the Web supply chain provides an abundance of weak links to target.
Digital Identity Is the New Security Control Plane
Commentary  |  1/28/2021  | 
Simplifying the management of security systems helps provide consistent protection for the new normal.
Data Privacy Day 2021: Pandemic Response Data Must Align with Data Privacy Rules
Commentary  |  1/28/2021  | 
Amid a pandemic, Data Privacy Day this year brings forth expanded responsibilities for organizations in the response to COVID-19.
4 Clues to Spot a Bot Network
Commentary  |  1/27/2021  | 
Protect against misinformation and disinformation campaigns by learning how to identify the bot networks spreading falsehoods.
Security's Inevitable Shift to the Edge
Commentary  |  1/27/2021  | 
As the edge becomes the place for DDoS mitigation, Web app security, and other controls, SASE is the management platform to handle them all.
Fighting the Rapid Rise of Cyber Warfare in a Changing World
Commentary  |  1/26/2021  | 
Global cyber warfare is a grim reality, but strong public-private relationships and security frameworks can safeguard people, institutions, and businesses.
Mainframe Security Automation Is Not a Luxury
Commentary  |  1/26/2021  | 
As cyber threats grow, even the most securable platform is vulnerable and requires adaptive autonomous protection.
Page 1 / 2   >   >>


Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26814
PUBLISHED: 2021-03-06
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service sc...
CVE-2021-27581
PUBLISHED: 2021-03-05
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
CVE-2021-28042
PUBLISHED: 2021-03-05
Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.
CVE-2021-28041
PUBLISHED: 2021-03-05
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
CVE-2021-3377
PUBLISHED: 2021-03-05
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.