Commentary
Content posted in September 2011
|
Eavesdropping Trojans Used In Cell Phone Spying Case
Israeli case a reminder of all types of social engineering threats
Identity Federation Versus PKI
Neither technology alone offers the ultimate user authentication infrastructure
New FFIEC Authentication Guidance Calls For Layers
Increased threats and weaknesses in certain accepted authentication mechanisms, FFIEC warns
Identity Federation: Waiting On Access Control
Separate authentication by websites will remain the reality until access control is done right in Web apps
7 Lessons: Surviving A Zero-Day Attack
Pacific Northwest National Laboratory CIO Jerry Johnson takes you inside the cyber attack that he faced down--and shares his security lessons learned.
Segregating DBA And Admin Duties
Keeping platform admins out of your database
Intel Demonstrates Potential Password-Killers
Intel presented two possible ways it plans to make passwords obsolete
0-Day SCADA Exploits Released, Publicly Exposed Servers At Risk
Italian researcher releases 0-day SCADA exploits leaving companies vulnerable to exploit; Emerging Threats project releases update to help detect attacks
Data Breach Avoidance Requires Copy Cops?
A U.S. senator proposes more data breach regulation, but experts say IT should be thinking data control. As one CSO recently put it, "The problem is not securing a copy of the data; it's securing data against copying."
Passwords: Time's Up?
Stronger authentication is a major security issue yet to be solved
Metasploit Gets Covert Forensics And PXE Boot Attack Capabilities
New Metasploit modules released during the Vegas security conferences add cool, new features, like covert forensics and PXE boot pwnage
Virtualization Security: No One Product Does It
VMware environments demand multiple tools to build barriers, trap intruders, maintain VM security-- and keep the Jason Cornishes out.
DAM In The Cloud
Modifications to DAM for use with cloud infrastructure providers
Virtualization Security: Your Biggest Risk Is Disgruntled Insider
Could 88 of your virtual servers be deleted by an angry insider during one McDonald's visit? Learn from Shionogi's experience.
Are Digital Certificates Doomed?
Certificates are fundamental to the Web's SSL security model. But the recent DigiNotar attack and Comodo hacks show that the system must be strengthened, experts say.
Hackers Turn On Each Other
WikiLeaks fumbles the disclosure of sensitive government cables, while hacking competition website RankMyHack.com finds little honor among members.
Don't Hate The 'Playas' -- Hate The Game
If Oracle wants to bitch about anything, it should bitch about how things get done in the halls of government -- Veracode is only trying to accelerate its growth
The Criticality Of Risk Assessments: FISMA, HIPAA, And Other Regs
Risk assessments are a critical part of regulatory compliance, but many organizations don't implement them well
|
White Papers
Video
0 Comments
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Bob, I told you incognito mode doesn't protect on those sites. Now I have to call IT, HR and animal control to clean up your mess.
Latest Comment: Bob, I told you incognito mode doesn't protect on those sites. Now I have to call IT, HR and animal control to clean up your mess.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2018-15583
PUBLISHED: 2019-03-25
PUBLISHED: 2019-03-25
PUBLISHED: 2019-03-25
PUBLISHED: 2019-03-25
PUBLISHED: 2019-03-25
From DHS/US-CERT's National Vulnerability Database CVE-2018-15583
PUBLISHED: 2019-03-25
Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
CVE-2017-7340PUBLISHED: 2019-03-25
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the applicationSearch parameter in the FortiView functionality.
CVE-2014-9187PUBLISHED: 2019-03-25
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recomme...
CVE-2014-9189PUBLISHED: 2019-03-25
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell...
CVE-2019-10044PUBLISHED: 2019-03-25
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters e...
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2019 UBM, All rights reserved
Tweet This