Commentary

Content posted in April 2015
Social Engineering Defenses: Reducing The Human Element
Commentary  |  4/30/2015  | 
Most security awareness advice is terrible, just plain bad, and not remotely feasible for your average user.
Big Data & The Security Skills Shortage
Commentary  |  4/29/2015  | 
Finding a security analyst with the data discovery experience to combat modern threats is like searching for the mythical unicorn. The person does not exist
To Evangelize Security, Get Out Of Your Comfort Zone
Commentary  |  4/28/2015  | 
If security professionals want to change corporate attitudes and culture, they need to step out of the echo chamber
Note To Vendors: CISOs Dont Want Your Analytical Tools
Commentary  |  4/28/2015  | 
What they need are solutions that deliver prioritized recommendations and confidence in the analytical rigor behind those recommendations to take meaningful action.
Cybersecurity: Dont Bank On It With 3rd Parties
Commentary  |  4/24/2015  | 
Not knowing that a contractors employee had access to system passwords is not a valid excuse when your clients records are stolen.
The Bad News For Infosec In The Target Settlement
Commentary  |  4/22/2015  | 
The legal argument behind the $10 million Class Action lawsuit and subsequent settlement is a gross misrepresentation of how attackers operate.
Health Insurers Digital Footprint Widening Attack Surface
Commentary  |  4/21/2015  | 
Insurers are ripe targets for attackers since theyre efficient concentrators of every kind of data needed for identity theft, credit card and insurance fraud. Heres proof.
DHS: Most Organizations Need Improvement In Managing Security Risk
Commentary  |  4/20/2015  | 
At a Department of Homeland Security Summit, government and corporate security teams are taken to task for failing to address critical issues of software assurance, testing and lifecycle support.
Inside the 4 Most Common Threat Actor Tools
Commentary  |  4/17/2015  | 
How do you prevent your environment from becoming the next target? Turn the tables on your attackers.
Harnessing The Power Of Cyber Threat Intelligence
Commentary  |  4/16/2015  | 
Here are six real-world examples of how changing your modus operandi from reactive to proactive can drive rapid response to the threats that matter.
Why Standardized Threat Data Will Help Stop the Next Big Breach
Commentary  |  4/15/2015  | 
Adopting industry standards for threat intelligence will reduce a lot of the heavy lifting and free cyber security first responders to focus on what they do best.
Setting Security Professionals Up For Success
Commentary  |  4/14/2015  | 
People, process, and technology are all integral to a successful infosec program. Whats too often missing involves the concept of workflow.
Better Together: Network Operations & Infosec
Commentary  |  4/13/2015  | 
Getting networking and information security teams together in the same room is a critical step for companies that want to build a continuous information security culture.
Insider Threats: Focus On The User, Not The Data
Commentary  |  4/10/2015  | 
Global cybersecurity spending will hit almost $77 billion in 2015, so why are there more high-profile leaks than ever?
Solving the Right Problem: Stop Adversaries, Not Just Their Tools
Commentary  |  4/9/2015  | 
A malware-centric strategy is mere childs play against todays sophisticated adversaries. Heres why.
5 Reasons You 'Better Call Saul' To Protect Corporate Data
Commentary  |  4/8/2015  | 
These pop-culture lessons from the entertaining Breaking Bad spinoff will make security awareness training both fun and effective.
So, You 'Dont Believe In' Security Education?
Commentary  |  4/7/2015  | 
You're in the minority for a reason. Here's why.
Obamas War On Hackers
Commentary  |  4/6/2015  | 
Cybersecurity legislation, for the most part, is a good idea. But not without protections for bug bounty programs and other vital, proactive security research.
The Good & Bad Of BYOD
Commentary  |  4/3/2015  | 
BYOD has very little to do with technology and everything to do with security, organizational politics, and human psychology.
Stuxnet Five Years Later: Did We Learn The Right Lesson?
Commentary  |  4/2/2015  | 
No! That's despite an abundance of best practices and standards that are shining light into the dark corners of industrial control system security.
Spring Cleaning In The SOC: Focus On the Inside Threat
Commentary  |  4/1/2015  | 
Along with warmer weather and melting snow, spring brings the perfect opportunity for user engagement. Heres how to transform insiders into your most sophisticated security device.


High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8980
PUBLISHED: 2019-02-21
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVE-2019-8979
PUBLISHED: 2019-02-21
Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.
CVE-2013-7469
PUBLISHED: 2019-02-21
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2018-20146
PUBLISHED: 2019-02-21
An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
CVE-2019-5727
PUBLISHED: 2019-02-21
Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.