Commentary

Content posted in April 2016
Stop Building Silos. Security Is Everyones Problem
Commentary  |  4/29/2016  | 
Yes, its true that the speed of DevOps has made security more difficult. But that doesnt mean accelerated release cycles and secure applications have to be mutually exclusive.
6 Reasons ISPs Must Step Up Defenses Against DDoS Attacks
Commentary  |  4/28/2016  | 
Conducting a DDoS attack used to require a significant amount of talent. But today, a high school student with basic hacking skills can access tools that will challenge even the most experienced ISP security teams.
8 Signs Your Security Culture Lacks Consistency
Commentary  |  4/27/2016  | 
Organizations that practice what they preach and match their actions to their words do far better achieving their goals than those that do not. Here's why that matters.
Crowdsourcing The Dark Web: A One-Stop Ran$om Shop
Commentary  |  4/26/2016  | 
Say hello to Ran$umBin, a new kind of ransom market dedicated to criminals and victims alike.
Surviving InfoSec: Digital Crime And Emotional Grime
Commentary  |  4/25/2016  | 
The never ending stream of threats, vulnerabilities, and potential attacks can take its toll on the typical security professional. Heres how to fight back against the pressure.
Dark Reading Marks 10th Anniversary With Month Of Special Coverage
Commentary  |  4/25/2016  | 
Looking back at the decade in security.
Be Prepared: How Proactivity Improves Cybersecurity Defense
Commentary  |  4/23/2016  | 
These five strategies will help you achieve a state of readiness in a landscape of unpredictable risk.
The Problem With Patching: 7 Top Complaints
Commentary  |  4/22/2016  | 
Is your security team suffering from patching fatigue? Check out these tips and eliminate critical vulnerabilities in your IT environment.
Mea Culpa: Time To Build Security Into Connectivity
Commentary  |  4/21/2016  | 
How those of us who spent decades developing faster, easier, and more scalable networking technology have made the lives of our security counterparts a living hell.
Security Lessons from C-3PO, Former CSO of the Millennium Falcon
Commentary  |  4/21/2016  | 
The business will take risks. When and how to speak up.
Internal Pen-Testing: Not Just For Compliance Audits Anymore
Commentary  |  4/20/2016  | 
How turning your internal penetration team into a 'Friendly Network Force' can identify and shut down the cracks in your security program.
Device Advice: Keeping Fraudsters From Consumer Info
Commentary  |  4/19/2016  | 
Data breaches are the first stop for criminals with intentions to steal personally identifiable information. These tips show how to fight fraud while optimizing the customer experience.
Privacy Debate: Apple & Google Today; AWS or Azure Tomorrow?
Commentary  |  4/18/2016  | 
Why the recent fight over mobile phone security and encryption is moving to the cloud.
Rethinking Application Security With Microservices Architectures
Commentary  |  4/15/2016  | 
The advantages offered by the container model go against many of the assumptions of traditional security mechanisms. Here are 5 new concepts & 4 best practices youll need to understand.
5 Steps to Improve Your Software Supply Chain Security
Commentary  |  4/14/2016  | 
Organizations that take control of their software supply chains will see tremendous gains in developer productivity, improved quality, and lower risk.
Java Deserialization: Running Faster Than a Bear
Commentary  |  4/14/2016  | 
Software components that were once good can sour instantly when new vulnerabilities are discovered within them. When that happens, the bears are coming, and you have to respond quickly.
Securing the Weakest Link: Insiders
Commentary  |  4/13/2016  | 
No longer is a hoodie-wearing malicious hacker the most obvious perpetrator of an inside cyber attack.
Managing The Message Before The Breach
Commentary  |  4/12/2016  | 
No leader wants to see their company exploited by creative cyber villains. Heres how CISOs can stay ahead of the game with a strategic plan.
Dark Reading Radio: Advancing Your Security Career
Commentary  |  4/12/2016  | 
INCYMI! Join us for a fascinating discussion on key trends and opportunities in the rapidly evolving world of cybersecurity.
7 Profiles Of Highly Risky Insiders
Commentary  |  4/8/2016  | 
To understand who these insiders are and why they pose a risk, start by looking at the root of the problem.
Context & Awareness: Its All About The Apps
Commentary  |  4/7/2016  | 
Why data context, application awareness and training are keys to mitigating security risks,
Understanding The Cloud Threat Surface
Commentary  |  4/6/2016  | 
How todays borderless environment creates new threat vectors from third-party apps, brute force password attacks, and login attempts with stolen credentials.
How to Hack Your Own Car
Commentary  |  4/5/2016  | 
As vehicles become more software-driven, car manufacturers are keeping the inner workings of electronics systems more secretive. Here's one way to maintain security updates and still preserve your 'freedom to tinker.'
CAs Need To Force Rules Around Trust
Commentary  |  4/4/2016  | 
Google Symantec flap reveals worrisome weakness in the CA system.
Avoiding Legal Landmines in Data Breach Response
Commentary  |  4/4/2016  | 
Building a legally defensible cybersecurity program means seeking out guidance from legal advisors before a serious incident forces you together.
Raising The Stakes For Application Security
Commentary  |  4/1/2016  | 
Why, if we already know most everything we need to know about exploited vulnerabilities in software, do hacks keep happening?


Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3937
PUBLISHED: 2018-08-14
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2018-3938
PUBLISHED: 2018-08-14
An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST r...
CVE-2018-12537
PUBLISHED: 2018-08-14
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
CVE-2018-12539
PUBLISHED: 2018-08-14
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows,...
CVE-2018-3615
PUBLISHED: 2018-08-14
Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.