Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
|
'Harvesting Attacks' & the Quantum Revolution
Stockpiles of stolen information sitting in foreign databases are ready to be exposed the minute there's a working quantum computer in five to ten years. The time to act is now.
Is Your Organization Suffering from Security Tool Sprawl?
Most companies have too many tools, causing increased costs and security issues.
Bridging the Gap Between Security & DevOps
An inside look into the engineering mindset of DevOps from the vantage of a career security professional.
Why You Need to Think About API Security
Businesses of all sorts are increasingly relying on APIs to interact with customers in smartphone apps, but they have their own unique set of vulnerabilities.
Long-Lining: Reeling In the Big Fish in Your Supply Chain
The object of this new attack campaign is not swordfish or tuna but high-ranking executives within target organizations.
The Future of Account Security: A World Without Passwords?
First step: Convince machines that we are who we say we are with expanded biometrics, including behaviors, locations, and other information that makes "us" us.
4 Cybersecurity Best Practices for Electrical Engineers
Most electrical engineering firms are targeted by threat actors of opportunity because of two necessary ingredients: people and computers. These four tips will help keep you safer.
6 Best Practices for Performing Physical Penetration Tests
A cautionary tale from a pen test gone wrong in an Iowa county courthouse.
How Network Logging Mitigates Legal Risk
Logging that is turned on, captured, and preserved immediately after a cyber event is proof positive that personal data didn't fall into the hands of a cybercriminal.
A Safer IoT Future Must Be a Joint Effort
We're just at the beginning of an important conversation about the future of our homes and cities, which must involve both consumers and many players in the industry
Deconstructing an iPhone Spearphishing Attack
How criminals today bypass smartphone anti-theft protection and harvest AppleID and passwords taken from fake Apple servers.
Crowdsourced Security & the Gig Economy
Crowdsourced platforms have redefined both pentesting and the cybersecurity gig economy. Just not in a good way.
DevSecOps: Recreating Cybersecurity Culture
Bringing developers and security teams together guided by a common goal requires some risk-taking. With patience and confidence, it will pay off. Here's how.
How Ransomware Criminals Turn Friends into Enemies
Managed service providers are the latest pawns in ransomware's game of chess.
5 Common Cloud Configuration Mistakes
It's a joint responsibility to keep data safe in the cloud. Here's what cloud customers must do to keep their end of the bargain.
How Intel Unlocks the Powerful Potential of Diversity in Cybersecurity
Sparking cultural shifts within an organization -- and throughout an entire industry -- can feel like a monumental task, but the juice is well worth the squeeze.
Preventing PTSD and Burnout for Cybersecurity Professionals
The safety of our digital lives is at stake, and we need to all do our part in raising awareness of these issues.
Taking a Fresh Look at Security Ops: 10 Tips
Maybe you love your executive team, your security processes, tools, or strategy. Maybe you hate them. Whatever the situation, it's likely at some point that things will have changed.
A Definitive Guide to Crowdsourced Vulnerability Management
Knowing about a bug and actually securing it are very different things. These six steps will get you from "oh, sh*t" to fixed.
The Fight Against Synthetic Identity Fraud
Advanced data and innovative technology will help organizations more easily identify abnormal behavior and tell legitimate customers apart from "fake" ones.
Proposed Browser Security Guidelines Would Mean More Work for IT Teams
CA/Browser Forum wants SSL certificates to expire after a year. Many businesses that rely on them aren't equipped to cope.
Firmware: A New Attack Vector Requiring Industry Leadership
It's time for cybersecurity manufacturers and solution providers to step up and show leadership in addressing firmware security. Read why and how.
Data Is the New Copper
Data breaches fuel a complex cybercriminal ecosystem, similar to copper thefts after the financial crisis.
AI Is Everywhere, but Don't Ignore the Basics
Artificial intelligence is no substitute for common sense, and it works best in combination with conventional cybersecurity technology. Here are the basic requirements and best practices you need to know.
From Spyware to Ninja Cable
Attackers don't need sophisticated James Bondian hardware to break into your company. Sometimes a $99 device will do.
Why Businesses Fail to Address DNS Security Exposures
Increasing awareness about the critical importance of DNS security is the first step in improving the risk of being attacked. It's time to get proactive.
Automation: Friend of the SOC Analyst
Faced by increasingly sophisticated threats, organizations are realizing the benefits of automation in their cybersecurity programs.
It's Not Healthy to Confuse Compliance with Security
Healthcare organizations should be alarmed by the frequency and severity of cyberattacks. Don't assume you're safe from them just because you're compliant with regulations.
An Inside Look at How CISOs Prioritize Budgets & Evaluate Vendors
In-depth interviews with four market-leading CISOs reveal how they prioritize budgets, measure ROI on security investments, and evaluate new vendors.
A Tale of Two Buzzwords: 'Automated' and 'Autonomous' Solutions Aren't the Same Thing
Enterprises must learn the difference between the two and the appropriate use cases for each.
3 Promising Technologies Making an Impact on Cybersecurity
The common thread: Each acts as a force multiplier, adding value to every other security technology around it.
Upping the Ante on Anti-Analysis
Attackers are becoming more sophisticated in their obfuscation and anti-analysis practices to avoid detection.
ISAC 101: Unlocking the Power of Information
How information sharing and analysis centers provide contextual threat information by creating communities that helps security professionals and their organizations grow in maturity and capability.
|
The 10 Most Impactful Types of Vulnerabilities for Enterprises TodayManaging system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
