Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
|
Machine Learning In Security: Seeing the Nth Dimension in Signatures
How adding “supervised” machine learning to the development of n-dimensional signature engines is moving the detection odds back to the defender.
'FBiOS' Case Heading For A New Firestorm
The surprise developments in the FBI v Apple case offer little reason to celebrate for encryption and privacy advocates.
Machine Learning In Security: Good & Bad News About Signatures
Why security teams that rely solely on signature-based detection are overwhelmed by a high number of alerts.
From NY To Bangladesh: Inside An Inexcusable Cyber Heist
A spelling error was the tipoff to last month’s multimillion-dollar digital bank heist. But could multifactor authentication have prevented it in the first place?
How 4 Startups Are Harnessing AI In The Invisible Cyberwar
Cybersecurity startups are setting their scopes on a potential goldmine of automated systems they hope will be more effective than hiring human enterprise security teams.
Mobile Security: Why App Stores Don’t Keep Users Safe
In a preview of his Black Hat Asia Briefing next week, a security researcher offers more proof of trouble in the walled gardens of the Apple and Google App stores.
Think Risk When You Talk About Application Security Today
Security from a risk-based perspective puts the focus on component failures and provides robust security for the ultimate target of most attacks -- company, customer and personal data.
Vuln Disclosure: Why Security Vendors & Researchers Don’t Trust Each Other
The security industry doesn’t need a one-size-fits all vulnerability disclosure policy. It needs a culture change. Getting everyone to the table is the first step.
Cloud Security: Understanding New Risks, Rising To New Challenges
In a business world dominated by the cloud, security ops has to change the way we play the game in order to accomplish our strategic goals.
Tell DR: What Are Your Biggest Unanswered Security Questions?
Fill us in, Dark Reading community. What challenges and mysteries leave you scratching your heads and throwing up your hands?
No Place For Tor In The Secured Workplace
When it comes to corporate security, anonymity does not necessarily ensure protection of one’s private information – nor that of your employer.
Security Lessons From My Stock Broker
Or, how to lie with metrics.
Beyond Back Doors: Recalibrating The Encryption Policy Debate
Three compelling reasons why access to back doors should not be the intelligence and law enforcement community’s main policy thrust in the fight against terrorism.
EU-US Privacy Shield: What Now, What Next?
The good news: We finally have a clear direction for continuing trans-Atlantic data transfer after several months in limbo. The bad news is in the remaining uncertainties.
CISO Playbook: Suit-up & Play Offense
In the game of IT security there are thousands of tools available, but the very best strategy to prepare for an opponent is to know your own weaknesses.
Dark Reading Radio: When Will Passwords Finally Die?
Join us this Wednesday, March 16, at 1pm EDT/10am PDT, for the next episode of Dark Reading Radio.
Understanding The 2 Sides Of Application Security Testing
Everybody likes to focus on the top 10 vulnerabilities, but I've never found a company with a top 10 vulnerabilities problem. Every company has a different top 10.
‘Must Haves’ & ‘Must Dos’ For The First Federal CISO
Offensive and defensive experience, public/private sector know-how, ‘mini-NSA’ mindset and vision are top traits we need in a chief information security officer.
Security Lessons From “The Gluten Lie”
How faith healers and security vendors have learned what lies work.
Why Security & DevOps Can’t Be Friends
Legacy applications are a brush fire waiting to happen. But retrofitting custom code built in the early 2000’s is just a small part of the application security problem.
Forgot My Password: Caption Contest Winners Announced
Sticky notes, clouds and authentication jokes. And the winning caption is...
A Warning for Wearables: Think Before You Emote
An examination of how wearable devices could become the modern equivalent of blogs broadcasting proprietary workplace information directly to the Internet of Things -- and beyond.
Cloud Survival Guide: 3 Tips For CISOs
To thrive in the cloud era, CISOs must refashion their roles as business enablers, adopt automation wherever possible, and go back to the basics on security hygiene.
Why Marrying Infosec & Info Governance Boosts Security Capabilities
In today’s data centric world, security pros need to know where sensitive data is supposed to be, not just where it actually is now.
IoT Security Checklist: Get Ahead Of The Curve
The security industry needs to take a Consumer Reports approach to Internet of Things product safety, including rigorous development practices and both physical and digital testing.
Why Your Security Tools Are Exposing You to Added Risks
The big lesson from 12 months of security product vulnerabilities: there’s no foundation of trust in any piece of software. They all represent a potential new attack vector.
Better Locks Than Back Doors: Why Apple Is Right About Encryption
What the landmark privacy case and a new documentary about Stuxnet both have to say about the encryption versus government oversight debate.
|
The 10 Most Impactful Types of Vulnerabilities for Enterprises TodayManaging system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
