Commentary

Content posted in May 2007
Why Catching The 'Spam King' Won't Save Your In-Box
Commentary  |  5/31/2007  | 
Even if a judge and jury lock up Robert Alan Soloway for the rest of his natural born life, your in-box will still be inundated with tons of offers for HGH, porn, and penny stocks.
Data Security: You're Not Learning From Others' Mistakes
Commentary  |  5/29/2007  | 
As I was catching up on some e-mail last night, I came across a message that's become all too familiar to me. It was textbook: A company was apologizing that one of its laptops had been stolen and that the laptop contained customer account and credit card information. A real yawner, until I considered that this e-mail was delivered to my personal e-mail account and that it was my customer account and credit card info that may have been compromised. Companies just aren't getting the messag
Vegas BBQ -- Burn, PC, Burn
Commentary  |  5/24/2007  | 
Picture a beautiful sunset over the desert, the glow of the Vegas skyline in the distance. Then a towering wave of flames leap into the air that crackles with the heat -- a man just set his computer on fire.
At Interop, Security Talk Is Largely About Network Access Control
Commentary  |  5/23/2007  | 
Here at Interop, there's a lot of focus on security and a lot of that security attention is aimed right at network access control. It's a hot-button topic here. The question plaguing many IT and security managers, though, might be where to get started.
(Missing) Without A Trace: The IBM Tapes
Commentary  |  5/18/2007  | 
Did you read about the missing IBM Tapes? It's almost like another undecipherable episode from "Lost," except it's a car that may have crashed in this case, apparently, and it's tapes that got lost in the aftermath.
The Top 10 Most Influential Security Visionaries Of All Time
Commentary  |  5/17/2007  | 
AT&T chief security officer Ed Amoroso, speaking before a packed auditorium Thursday at his company's cybersecurity conference, wanted to test the collective knowledge of those in the room. How well-studied were they in the visionaries who've had the greatest impact on IT security? Not very well, it turns out, as few could put
Lost Your Data? What's It Worth To You?
Commentary  |  5/16/2007  | 
Should virtue be its own reward when it comes to returning lost data these days? Sharon Gaudin's story about IBM's plea to find lost tapes with sensitive employee data really got me into one of those Stephen Colbert finger-wagging moments.
If An FBI Analyst Can Steal National Secrets, What Are Your Workers Lifting?
Commentary  |  5/15/2007  | 
Looking back on the story about the former Marine and FBI analyst who stole classified information from both the White House and the FBI's own database, I think there are some important lessons to be learned from this one.
A Day In The Life Of Cigna's CISO: 7 Things You Didn't Know
Commentary  |  5/11/2007  | 
I recently visited Cigna chief information security officer Craig Shumard at his company's offices in suburban Connecticut. On a clear, sunny day that slowly melted away the last vestiges of winter -- mostly scattered mounds of snow encrusted with rock and dirt -- across the rolling hills of the employee benefits provider's campus, I got to see firsthand how the security chief at a big-time company operates and interacts with his staff. It was impressive, to say the least.
Why Do Workers Steal Data?
Commentary  |  5/10/2007  | 
I was fascinated by Sharon Gaudin's recent article reporting that 45% of professionals steal data when they leave their jobs. I couldn't help wondering why they do it. A desire to suck up to their new supervisors? A sense of grievance against the company that they're leaving? Or just because they can?
Besieged E-Gold Founder Claims (Not Unconvincingly) To Be Victim Of A Fed Vendetta
Commentary  |  5/2/2007  | 
Bloggers live for feedback to their controversial postings and in this regard, my entry earlier this week about a federal grand jury's decision late last week to indict E Gold Ltd, Gold & Silver Reserve Inc., and the owners of these digital currency businesses on charges of money laundering, conspiracy, and operating an unlicensed money transmitting business did not disappoint. The following day, I recei


6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.