Commentary

Content posted in October 2011
Basic Baselining For Quick Situational Awareness
Commentary  |  10/28/2011  | 
Baselines can be extremely valuable in knowing what's going on within your network, but they can't help if they're not created -- start with the basics
UBS Finds Risk Management Stress Test Costly
Commentary  |  10/25/2011  | 
UBS failed to stop a single rogue trader from racking up $2 billion in losses. Yet, some experts argue that banks overall may be better than others at managing risk.
Sinkholing For Profit
Commentary  |  10/24/2011  | 
Concerns over the legality and ethics of security organizations that profit from their sinkhole operations
Does Cybercrime Pay?
Commentary  |  10/21/2011  | 
Turning a profit in today's underground economy remains tough. Here's why.
Authentication Reality Check
Commentary  |  10/18/2011  | 
Two-factor authentication products slow to catch on
On Trusting Certificate Authorities
Commentary  |  10/18/2011  | 
The time has come for a way to vet CAs by reputation
Authentication With Hardware
Commentary  |  10/18/2011  | 
Needed: a unified way for users to log in websites regardless of the device they are using
FFIEC Goes Beyond Traditional Authentication
Commentary  |  10/18/2011  | 
The FFIEC recommends that organizations provide additional business and fraud detection controls to offset weaknesses in authentication technology
Pro Pen Testing: The Zero-Knowledge Approach
Commentary  |  10/14/2011  | 
Special care must be taken in a penetration test that locates targets with 'zero-knowledge'
McAfee + NitroSecurity: SIEM Merger Done Right
Commentary  |  10/12/2011  | 
McAfee showcases the perfect security company merger by bringing out a SIEM offering that better anticipates an increasingly hostile world
Advanced Threats And Scenario-Based Penetration Testing
Commentary  |  10/12/2011  | 
Why your pen-test efforts probably aren't preparing you for the worst
DerbyCon Fosters Community -- Videos Available Online
Commentary  |  10/7/2011  | 
DerbyCon's successful first year reminds us of what the security community is all about: sharing and learning from others, promoting new ideas, and advancing the art of security
Steve Jobs And Tech Security
Commentary  |  10/6/2011  | 
Apple's products continue to highlight what relatively secure operating system environments look like.
Most Consumers Don't Lock Mobile Phone Via PIN
Commentary  |  10/4/2011  | 
44% of respondents say its's too much of a hassle, new survey reports.


Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19349
PUBLISHED: 2018-11-17
In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.
CVE-2018-19350
PUBLISHED: 2018-11-17
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
CVE-2018-19341
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader...
CVE-2018-19342
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation starting at U3DBrowser+0x00000000...
CVE-2018-19343
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a "Data from Faul...