Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Commentary

Content posted in March 2016
Machine Learning In Security: Seeing the Nth Dimension in Signatures
Commentary  |  3/31/2016  | 
How adding “supervised” machine learning to the development of n-dimensional signature engines is moving the detection odds back to the defender.
'FBiOS' Case Heading For A New Firestorm
Commentary  |  3/30/2016  | 
The surprise developments in the FBI v Apple case offer little reason to celebrate for encryption and privacy advocates.
Machine Learning In Security: Good & Bad News About Signatures
Commentary  |  3/30/2016  | 
Why security teams that rely solely on signature-based detection are overwhelmed by a high number of alerts.
From NY To Bangladesh: Inside An Inexcusable Cyber Heist
Commentary  |  3/29/2016  | 
A spelling error was the tipoff to last month’s multimillion-dollar digital bank heist. But could multifactor authentication have prevented it in the first place?
How 4 Startups Are Harnessing AI In The Invisible Cyberwar
Commentary  |  3/25/2016  | 
Cybersecurity startups are setting their scopes on a potential goldmine of automated systems they hope will be more effective than hiring human enterprise security teams.
Mobile Security: Why App Stores Don’t Keep Users Safe
Commentary  |  3/24/2016  | 
In a preview of his Black Hat Asia Briefing next week, a security researcher offers more proof of trouble in the walled gardens of the Apple and Google App stores.
Think Risk When You Talk About Application Security Today
Commentary  |  3/23/2016  | 
Security from a risk-based perspective puts the focus on component failures and provides robust security for the ultimate target of most attacks -- company, customer and personal data.
Vuln Disclosure: Why Security Vendors & Researchers Don’t Trust Each Other
Commentary  |  3/22/2016  | 
The security industry doesn’t need a one-size-fits all vulnerability disclosure policy. It needs a culture change. Getting everyone to the table is the first step.
Cloud Security: Understanding New Risks, Rising To New Challenges
Commentary  |  3/21/2016  | 
In a business world dominated by the cloud, security ops has to change the way we play the game in order to accomplish our strategic goals.
Tell DR: What Are Your Biggest Unanswered Security Questions?
Commentary  |  3/19/2016  | 
Fill us in, Dark Reading community. What challenges and mysteries leave you scratching your heads and throwing up your hands?
No Place For Tor In The Secured Workplace
Commentary  |  3/18/2016  | 
When it comes to corporate security, anonymity does not necessarily ensure protection of one’s private information – nor that of your employer.
Security Lessons From My Stock Broker
Commentary  |  3/17/2016  | 
Or, how to lie with metrics.
Beyond Back Doors: Recalibrating The Encryption Policy Debate
Commentary  |  3/17/2016  | 
Three compelling reasons why access to back doors should not be the intelligence and law enforcement community’s main policy thrust in the fight against terrorism.
EU-US Privacy Shield: What Now, What Next?
Commentary  |  3/16/2016  | 
The good news: We finally have a clear direction for continuing trans-Atlantic data transfer after several months in limbo. The bad news is in the remaining uncertainties.
CISO Playbook: Suit-up & Play Offense
Commentary  |  3/15/2016  | 
In the game of IT security there are thousands of tools available, but the very best strategy to prepare for an opponent is to know your own weaknesses.
Dark Reading Radio: When Will Passwords Finally Die?
Commentary  |  3/14/2016  | 
Join us this Wednesday, March 16, at 1pm EDT/10am PDT, for the next episode of Dark Reading Radio.
Understanding The 2 Sides Of Application Security Testing
Commentary  |  3/14/2016  | 
Everybody likes to focus on the top 10 vulnerabilities, but I've never found a company with a top 10 vulnerabilities problem. Every company has a different top 10.
‘Must Haves’ & ‘Must Dos’ For The First Federal CISO
Commentary  |  3/11/2016  | 
Offensive and defensive experience, public/private sector know-how, ‘mini-NSA’ mindset and vision are top traits we need in a chief information security officer.
Security Lessons From “The Gluten Lie”
Commentary  |  3/10/2016  | 
How faith healers and security vendors have learned what lies work.
Why Security & DevOps Can’t Be Friends
Commentary  |  3/9/2016  | 
Legacy applications are a brush fire waiting to happen. But retrofitting custom code built in the early 2000’s is just a small part of the application security problem.
Forgot My Password: Caption Contest Winners Announced
Commentary  |  3/8/2016  | 
Sticky notes, clouds and authentication jokes. And the winning caption is...
A Warning for Wearables: Think Before You Emote
Commentary  |  3/8/2016  | 
An examination of how wearable devices could become the modern equivalent of blogs broadcasting proprietary workplace information directly to the Internet of Things -- and beyond.
Cloud Survival Guide: 3 Tips For CISOs
Commentary  |  3/7/2016  | 
To thrive in the cloud era, CISOs must refashion their roles as business enablers, adopt automation wherever possible, and go back to the basics on security hygiene.
Why Marrying Infosec & Info Governance Boosts Security Capabilities
Commentary  |  3/4/2016  | 
In today’s data centric world, security pros need to know where sensitive data is supposed to be, not just where it actually is now.
IoT Security Checklist: Get Ahead Of The Curve
Commentary  |  3/3/2016  | 
The security industry needs to take a Consumer Reports approach to Internet of Things product safety, including rigorous development practices and both physical and digital testing.
Why Your Security Tools Are Exposing You to Added Risks
Commentary  |  3/2/2016  | 
The big lesson from 12 months of security product vulnerabilities: there’s no foundation of trust in any piece of software. They all represent a potential new attack vector.
Better Locks Than Back Doors: Why Apple Is Right About Encryption
Commentary  |  3/1/2016  | 
What the landmark privacy case and a new documentary about Stuxnet both have to say about the encryption versus government oversight debate.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file