Commentary
Latest Content
|
The Security Perimeter Is Dead; Long Live the New Endpoint Perimeter
The network no longer provides an air gap against external threats, but access devices can take up the slack.
Simulating Lateral Attacks Through Email
A skilled attacker can get inside your company by abusing common email applications. Here are three strategies to block them.
How the US Chooses Which Zero-Day Vulnerabilities to Stockpile
When it comes to acceptable circumstances for government disclosure of zero-days, the new Vulnerabilities Equity Process might be the accountability practice security advocates have been waiting for.
Are You Listening to Your Kill Chain?
With the right tools and trained staff, any organization should be able to deal with threats before information is compromised.
Online Fraud: Now a Major Application Layer Security Problem
The explosion of consumer-facing online services and applications is making it easier and cheaper for cybercriminals to host malicious content and launch attacks.
Why Cyberattacks Are the No. 1 Risk
The paradigm shift toward always-on IT requires business leaders to rethink their defense strategy.
Advanced Phishing Scenarios You Will Most Likely Encounter This Year
In 2019, there will be no end in sight to email-driven cybercrime such as business email compromise, spearphishing, and ransomware.
Kudos to the Unsung Rock Stars of Security
It is great to have heroes, but the real security heroes are the men and women who keep the bad guys out while fighting their own organizations at the same time.
Election Security Isn't as Bad as People Think
Make no mistake, however: We'll always have to be on guard. And we can take some lessons from the world of industrial cybersecurity.
6 Best Practices for Managing an Online Educational Infrastructure
Universities must keep pace with rapidly changing technology to help thwart malicious hacking attempts and protect student information.
Cutting Through the Jargon of AI & ML: 5 Key Issues
Ask the tough questions before you invest in artificial intelligence and machine learning technology. The security of your enterprise depends on it.
Security at the Speed of DevOps: Maturity, Orchestration, and Detection
Container and microservices technologies, including the orchestrator Kubernetes, create an extraordinary opportunity to build infrastructure and applications that are secure by design.
Your Life Is the Attack Surface: The Risks of IoT
To protect yourself, you must know where you're vulnerable — and these tips can help.
Security Matters When It Comes to Mergers & Acquisitions
The recently disclosed Marriott breach exposed a frequently ignored issue in the M&A process.
Threat of a Remote Cyberattack on Today's Aircraft Is Real
We need more stringent controls and government action to prevent a catastrophic disaster.
Managing Security in Today's Compliance and Regulatory Environment
Instead of losing sight of the cybersecurity forest as we navigate the compliance trees, consolidate and simplify regulatory compliance efforts to keep your eyes on the security prize.
Taming the Digital Wild West
Congress must do more to encourage good Samaritan efforts in the cybersecurity community and make it easier for law enforcement to consistently collaborate with them.
Redefining Critical Infrastructure for the Age of Disinformation
In an era of tighter privacy laws, it's important to create an online environment that uses threat intelligence productively to defeat disinformation campaigns and bolster democracy.
25 Years Later: Looking Back at the First Great (Cyber) Bank Heist
The Citibank hack in 1994 marked a turning point for banking -- and cybercrime -- as we know it. What can we learn from looking back at the past 25 years?
Start Preparing Now for the Post-Quantum Future
Quantum computing will break most of the encryption schemes on which we rely today. These five tips will help you get ready.
Toxic Data: How 'Deepfakes' Threaten Cybersecurity
The joining of 'deep learning' and 'fake news' makes it possible to create audio and video of real people saying words they never spoke or things they never did.
3 Steps for Cybersecurity Leaders to Bridge the Gender Equality Gap
By encouraging female participation through education and retaining this interest through an inclusive culture and visible role models, we can begin to close the skill and gender gap in cybersecurity.
I Spy: Dark Reading Caption Contest Winners
No shortage of political humor and inside security jokes in this batch of cartoon caption contenders. And the winners are ...
How to Optimize Security Spending While Reducing Risk
Risk scoring is a way of getting everyone on the same page with a consistent, reliable method of gathering and analyzing security data.
2018 In the Rearview Mirror
Among this year's biggest news stories: epic hardware vulnerabilities, a more lethal form of DDoS attack, Olympic 'false flags,' hijacked home routers, fileless malware — and a new world's record for data breaches.
Automating a DevOps-Friendly Security Policy
There can be a clash of missions between security and IT Ops teams, but automation can help.
Privacy Futures: Fed-up Consumers Take Their Data Back
In 2019, usable security will become the new buzzword and signal a rejection of the argument that there must be a trade-off between convenience and security and privacy.
Cybersecurity in 2019: From IoT & Struts to Gray Hats & Honeypots
While you prepare your defenses against the next big thing, also pay attention to the longstanding threats that the industry still hasn't put to rest.
Cryptographic Erasure: Moving Beyond Hard Drive Destruction
In the good old days, incinerating backup tapes or shredding a few hard drives would have solved the problem. Today, we have a bigger challenge.
How to Engage Your Cyber Enemies
Having the right mix of tools, automation, and intelligence is key to staying ahead of new threats and protecting your organization.
Shhhhh! The Secret to Secrets Management
Companies need to take a centralized approach to protecting confidential data and assets. Here are 12 ways to get a handle on the problem.
Retailers: Avoid the Hackable Holidaze
The most wonderful time of the year? Sure, but not if your business and customers are getting robbed.
Setting the Table for Effective Cybersecurity: 20 Culinary Questions
Even the best chefs will produce an inferior product if they begin with the wrong ingredients.
The Economics Fueling IoT (In)security
Attackers understand the profits that lie in the current lack of security. That must change.
Deception: Honey vs. Real Environments
A primer on choosing deception technology that will provide maximum efficacy without over-committing money, time and resources.
Forget Shifting Security Left; It's Time to Race Left
Once DevOps teams decide to shift left, they can finally look forward instead of backward.
The Grinch Bot Before Christmas: A Security Story for the Holidays
Once upon a time, buyers purchased products from certified sellers. Today, hoarders use botnets to amass goods at significant markup for a new gray-market economy.
How Well Is Your Organization Investing Its Cybersecurity Dollars?
The principles, methods, and tools for performing good risk measurement already exist and are being used successfully by organizations today. They take some effort -- and are totally worth it.
6 Cloud Security Predictions for 2019
How the fast pace of cloud computing adoption in 2018 will dramatically change the security landscape next year.
Insider Threats & Insider Objections
The ‘tyranny of the urgent’ and three other reasons why it’s hard for CISOs to establish a robust insider threat prevention program.
Bringing Compliance into the SecDevOps Process
Application security should be guided by its responsibility to maintain the confidentiality, integrity, and availability of systems and data. But often, compliance clouds the picture.
4 Lessons Die Hard Teaches About Combating Cyber Villains
With proper planning, modern approaches, and tools, we can all be heroes in the epic battle against the cyber threat.
Boosting SOC IQ Levels with Knowledge Transfer
Despite shortages of skills and staff, these six best practices can improve analysts' performance in a security operations center.
A Shift from Cybersecurity to Cyber Resilience: 6 Steps
Getting to cyber resilience means federal agencies must think differently about how they build and implement their systems. Here's where to begin.
The Case for a Human Security Officer
Wanted: a security exec responsible for identifying and mitigating the attack vectors and vulnerabilities specifically targeting and involving people.
5 Emerging Trends in Cybercrime
Organizations can start today to protect against 2019's threats. Look out for crooks using AI "fuzzing" techniques, machine learning, and swarms.
Filling the Cybersecurity Jobs Gap – Now and in the Future
Employers must start broadening their search for experienced security professionals to include people with the right traits rather than the right skills.
Threat Hunting: Improving Bot Detection in Enterprise SD-WANs
How security researchers tracked down Kuai and Bujoi malware through multiple vectors including client type, traffic frequency, and destination.
Establishing True Trust in a Zero-Trust World
Our goal should not be to merely accept zero trust but gain the visibility required to establish true trust.
The Return of Email Flooding
An old attack technique is making its way back into the mainstream with an onslaught of messages that legacy tools and script writing can't easily detect.
|
White Papers
Video
8 Comments
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I don't mind him using my phone. I mind that he's able to unlock it with FaceID."
Latest Comment: "I don't mind him using my phone. I mind that he's able to unlock it with FaceID."
Current Issue
The Year in Security 2018This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2019-6487
PUBLISHED: 2019-01-18
PUBLISHED: 2019-01-17
PUBLISHED: 2019-01-17
PUBLISHED: 2019-01-17
PUBLISHED: 2019-01-17
From DHS/US-CERT's National Vulnerability Database CVE-2019-6487
PUBLISHED: 2019-01-18
TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.
CVE-2018-20735PUBLISHED: 2019-01-17
** DISPUTED ** An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...
CVE-2019-0624PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2019 UBM, All rights reserved
Tweet This