Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Commentary

Content posted in April 2015
Social Engineering Defenses: Reducing The Human Element
Commentary  |  4/30/2015  | 
Most security awareness advice is terrible, just plain bad, and not remotely feasible for your average user.
Big Data & The Security Skills Shortage
Commentary  |  4/29/2015  | 
Finding a security analyst with the data discovery experience to combat modern threats is like searching for the mythical unicorn. The person does not exist
To Evangelize Security, Get Out Of Your Comfort Zone
Commentary  |  4/28/2015  | 
If security professionals want to change corporate attitudes and culture, they need to step out of the echo chamber
Note To Vendors: CISOs Dont Want Your Analytical Tools
Commentary  |  4/28/2015  | 
What they need are solutions that deliver prioritized recommendations and confidence in the analytical rigor behind those recommendations to take meaningful action.
Cybersecurity: Dont Bank On It With 3rd Parties
Commentary  |  4/24/2015  | 
Not knowing that a contractors employee had access to system passwords is not a valid excuse when your clients records are stolen.
The Bad News For Infosec In The Target Settlement
Commentary  |  4/22/2015  | 
The legal argument behind the $10 million Class Action lawsuit and subsequent settlement is a gross misrepresentation of how attackers operate.
Health Insurers Digital Footprint Widening Attack Surface
Commentary  |  4/21/2015  | 
Insurers are ripe targets for attackers since theyre efficient concentrators of every kind of data needed for identity theft, credit card and insurance fraud. Heres proof.
DHS: Most Organizations Need Improvement In Managing Security Risk
Commentary  |  4/20/2015  | 
At a Department of Homeland Security Summit, government and corporate security teams are taken to task for failing to address critical issues of software assurance, testing and lifecycle support.
Inside the 4 Most Common Threat Actor Tools
Commentary  |  4/17/2015  | 
How do you prevent your environment from becoming the next target? Turn the tables on your attackers.
Harnessing The Power Of Cyber Threat Intelligence
Commentary  |  4/16/2015  | 
Here are six real-world examples of how changing your modus operandi from reactive to proactive can drive rapid response to the threats that matter.
Why Standardized Threat Data Will Help Stop the Next Big Breach
Commentary  |  4/15/2015  | 
Adopting industry standards for threat intelligence will reduce a lot of the heavy lifting and free cyber security first responders to focus on what they do best.
Setting Security Professionals Up For Success
Commentary  |  4/14/2015  | 
People, process, and technology are all integral to a successful infosec program. Whats too often missing involves the concept of workflow.
Better Together: Network Operations & Infosec
Commentary  |  4/13/2015  | 
Getting networking and information security teams together in the same room is a critical step for companies that want to build a continuous information security culture.
Insider Threats: Focus On The User, Not The Data
Commentary  |  4/10/2015  | 
Global cybersecurity spending will hit almost $77 billion in 2015, so why are there more high-profile leaks than ever?
Solving the Right Problem: Stop Adversaries, Not Just Their Tools
Commentary  |  4/9/2015  | 
A malware-centric strategy is mere childs play against todays sophisticated adversaries. Heres why.
5 Reasons You 'Better Call Saul' To Protect Corporate Data
Commentary  |  4/8/2015  | 
These pop-culture lessons from the entertaining Breaking Bad spinoff will make security awareness training both fun and effective.
So, You 'Dont Believe In' Security Education?
Commentary  |  4/7/2015  | 
You're in the minority for a reason. Here's why.
Obamas War On Hackers
Commentary  |  4/6/2015  | 
Cybersecurity legislation, for the most part, is a good idea. But not without protections for bug bounty programs and other vital, proactive security research.
The Good & Bad Of BYOD
Commentary  |  4/3/2015  | 
BYOD has very little to do with technology and everything to do with security, organizational politics, and human psychology.
Stuxnet Five Years Later: Did We Learn The Right Lesson?
Commentary  |  4/2/2015  | 
No! That's despite an abundance of best practices and standards that are shining light into the dark corners of industrial control system security.
Spring Cleaning In The SOC: Focus On the Inside Threat
Commentary  |  4/1/2015  | 
Along with warmer weather and melting snow, spring brings the perfect opportunity for user engagement. Heres how to transform insiders into your most sophisticated security device.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Practical Network Security Approaches for a Multicloud, Hybrid IT World
The report covers areas enterprises should focus on for their multicloud/hybrid cloud security strategy: -increase visibility over the environment -learning cloud-specific skills -relying on established security frameworks -re-architecting the network
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-30333
PUBLISHED: 2022-05-09
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
CVE-2022-23066
PUBLISHED: 2022-05-09
In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to tra...
CVE-2022-28463
PUBLISHED: 2022-05-08
ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
CVE-2022-28470
PUBLISHED: 2022-05-08
marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
CVE-2022-1620
PUBLISHED: 2022-05-08
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.