Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Commentary

Content posted in April 2015
Social Engineering Defenses: Reducing The Human Element
Commentary  |  4/30/2015  | 
Most security awareness advice is terrible, just plain bad, and not remotely feasible for your average user.
Big Data & The Security Skills Shortage
Commentary  |  4/29/2015  | 
Finding a security analyst with the data discovery experience to combat modern threats is like searching for the mythical unicorn. The person does not exist
To Evangelize Security, Get Out Of Your Comfort Zone
Commentary  |  4/28/2015  | 
If security professionals want to change corporate attitudes and culture, they need to step out of the echo chamber
Note To Vendors: CISOs Dont Want Your Analytical Tools
Commentary  |  4/28/2015  | 
What they need are solutions that deliver prioritized recommendations and confidence in the analytical rigor behind those recommendations to take meaningful action.
Cybersecurity: Dont Bank On It With 3rd Parties
Commentary  |  4/24/2015  | 
Not knowing that a contractors employee had access to system passwords is not a valid excuse when your clients records are stolen.
The Bad News For Infosec In The Target Settlement
Commentary  |  4/22/2015  | 
The legal argument behind the $10 million Class Action lawsuit and subsequent settlement is a gross misrepresentation of how attackers operate.
Health Insurers Digital Footprint Widening Attack Surface
Commentary  |  4/21/2015  | 
Insurers are ripe targets for attackers since theyre efficient concentrators of every kind of data needed for identity theft, credit card and insurance fraud. Heres proof.
DHS: Most Organizations Need Improvement In Managing Security Risk
Commentary  |  4/20/2015  | 
At a Department of Homeland Security Summit, government and corporate security teams are taken to task for failing to address critical issues of software assurance, testing and lifecycle support.
Inside the 4 Most Common Threat Actor Tools
Commentary  |  4/17/2015  | 
How do you prevent your environment from becoming the next target? Turn the tables on your attackers.
Harnessing The Power Of Cyber Threat Intelligence
Commentary  |  4/16/2015  | 
Here are six real-world examples of how changing your modus operandi from reactive to proactive can drive rapid response to the threats that matter.
Why Standardized Threat Data Will Help Stop the Next Big Breach
Commentary  |  4/15/2015  | 
Adopting industry standards for threat intelligence will reduce a lot of the heavy lifting and free cyber security first responders to focus on what they do best.
Setting Security Professionals Up For Success
Commentary  |  4/14/2015  | 
People, process, and technology are all integral to a successful infosec program. Whats too often missing involves the concept of workflow.
Better Together: Network Operations & Infosec
Commentary  |  4/13/2015  | 
Getting networking and information security teams together in the same room is a critical step for companies that want to build a continuous information security culture.
Insider Threats: Focus On The User, Not The Data
Commentary  |  4/10/2015  | 
Global cybersecurity spending will hit almost $77 billion in 2015, so why are there more high-profile leaks than ever?
Solving the Right Problem: Stop Adversaries, Not Just Their Tools
Commentary  |  4/9/2015  | 
A malware-centric strategy is mere childs play against todays sophisticated adversaries. Heres why.
5 Reasons You 'Better Call Saul' To Protect Corporate Data
Commentary  |  4/8/2015  | 
These pop-culture lessons from the entertaining Breaking Bad spinoff will make security awareness training both fun and effective.
So, You 'Dont Believe In' Security Education?
Commentary  |  4/7/2015  | 
You're in the minority for a reason. Here's why.
Obamas War On Hackers
Commentary  |  4/6/2015  | 
Cybersecurity legislation, for the most part, is a good idea. But not without protections for bug bounty programs and other vital, proactive security research.
The Good & Bad Of BYOD
Commentary  |  4/3/2015  | 
BYOD has very little to do with technology and everything to do with security, organizational politics, and human psychology.
Stuxnet Five Years Later: Did We Learn The Right Lesson?
Commentary  |  4/2/2015  | 
No! That's despite an abundance of best practices and standards that are shining light into the dark corners of industrial control system security.
Spring Cleaning In The SOC: Focus On the Inside Threat
Commentary  |  4/1/2015  | 
Along with warmer weather and melting snow, spring brings the perfect opportunity for user engagement. Heres how to transform insiders into your most sophisticated security device.


News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29458
PUBLISHED: 2021-04-19
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An att...
CVE-2021-31254
PUBLISHED: 2021-04-19
Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid IV sizes.
CVE-2021-31255
PUBLISHED: 2021-04-19
Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
CVE-2021-31256
PUBLISHED: 2021-04-19
Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
CVE-2021-31257
PUBLISHED: 2021-04-19
The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.