Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

News & Commentary
How Intel Unlocks the Powerful Potential of Diversity in Cybersecurity
Jim Gordon, GM, Ecosystem Strategy & Business Development, Intel Platform Security DivisionCommentary
Sparking cultural shifts within an organization -- and throughout an entire industry -- can feel like a monumental task, but the juice is well worth the squeeze.
By Jim Gordon GM, Ecosystem Strategy & Business Development, Intel Platform Security Division, 9/17/2019
Comment0 comments  |  Read  |  Post a Comment
6 Questions to Ask Once Youve Learned of a Breach
Steve Zurier, Contributing Writer
With GDPR enacted and the California Consumer Privacy Act on the near horizon, companies have to sharpen up their responses. Start by asking these six questions.
By Steve Zurier Contributing Writer, 9/13/2019
Comment1 Comment  |  Read  |  Post a Comment
Proposed Browser Security Guidelines Would Mean More Work for IT Teams
Chris Hickman, Chief Security Officer at KeyfactorCommentary
CA/Browser Forum wants SSL certificates to expire after a year. Many businesses that rely on them aren't equipped to cope.
By Chris Hickman Chief Security Officer at Keyfactor, 9/11/2019
Comment0 comments  |  Read  |  Post a Comment
It's Not Healthy to Confuse Compliance with Security
Todd Weller, Chief Strategy Officer at Bandura CyberCommentary
Healthcare organizations should be alarmed by the frequency and severity of cyberattacks. Don't assume you're safe from them just because you're compliant with regulations.
By Todd Weller Chief Strategy Officer at Bandura Cyber, 9/5/2019
Comment5 comments  |  Read  |  Post a Comment
Rising Fines Will Push Breach Costs Much Higher
Robert Lemos, Contributing WriterNews
The cost of breaches will rise by two-thirds over the next five years, exceeding an estimated $5 trillion in 2024, primarily driven by higher fines as more jurisdictions punish companies for lax security.
By Robert Lemos Contributing Writer, 9/4/2019
Comment0 comments  |  Read  |  Post a Comment
SafeGuard Cyber Adds Security, Compliance Capabilities for WeChat
Dark Reading Staff, Quick Hits
A lack of visibility into the app could expose business users to compliance risks and security threats, the company says.
By Dark Reading Staff , 8/22/2019
Comment0 comments  |  Read  |  Post a Comment
'Phoning Home': Your Latest Data Exfiltration Headache
Jeff Costlow, CISO, ExtraHopCommentary
Companies phone enterprise customer data home securely and for a variety of perfectly legitimate and useful reasons. The problems stem from insufficient disclosure.
By Jeff Costlow CISO, ExtraHop, 8/21/2019
Comment0 comments  |  Read  |  Post a Comment
Compliance Training? What Compliance Training?
Beyond the Edge, Dark Reading
Employees can run ... but they can't hide. Or can they?
By Beyond the Edge Dark Reading, 8/19/2019
Comment0 comments  |  Read  |  Post a Comment
Security Pros, Congress Reps Talk National Cybersecurity at DEF CON
Kelly Sheridan, Staff Editor, Dark ReadingNews
Cybersecurity and government leaders discussed why Congress is unprepared for a major cyberattack and how the two parties can collaborate.
By Kelly Sheridan Staff Editor, Dark Reading, 8/12/2019
Comment0 comments  |  Read  |  Post a Comment
It's (Still) the Password, Stupid!
Sam Bocetta, Security AnalystCommentary
The best way to protect your identity in cyberspace is the simplest: Use a variety of strong passwords, and never, ever, use "123456" no matter how easy it is to type.
By Sam Bocetta Security Analyst, 8/9/2019
Comment3 comments  |  Read  |  Post a Comment
Yes, FaceApp Really Could Be Sending Your Data to Russia
Marc Rogers, Executive Director of Cybersecurity, OktaCommentary
FaceApp has an unprecedented level of access to data from 150 million users. What could its endgame be? We unpack three potential risks.
By Marc Rogers Executive Director of Cybersecurity, Okta, 8/8/2019
Comment0 comments  |  Read  |  Post a Comment
Cisco Pays $8.6M in First False Claims Suit for Vulnerabilities in Security Product
Robert Lemos, Contributing WriterNews
A security consultant reported vulnerabilities in Cisco's Video Surveillance Manager in 2009 but the company ignored the issues and fired the consultant.
By Robert Lemos Contributing Writer, 8/1/2019
Comment0 comments  |  Read  |  Post a Comment
Companies' 'Anonymized' Data May Violate GDPR, Privacy Regs
Robert Lemos, Contributing WriterNews
New study found that any database containing 15 pieces of demographic data could be used to identify individuals.
By Robert Lemos Contributing Writer, 7/26/2019
Comment3 comments  |  Read  |  Post a Comment
Answer These 9 Questions to Determine if Your Data Is Safe
Chad Cragle, Information Security Officer at FormAssemblyCommentary
Data protection regulations are only going to grow tighter. Make sure you're keeping the customer's best interests in mind.
By Chad Cragle Information Security Officer at FormAssembly, 7/25/2019
Comment9 comments  |  Read  |  Post a Comment
6 Actions That Made GDPR Real in 2019
Steve Zurier, Contributing Writer
In the wake of recent fines levied against British Airways, Marriott, and Facebook, companies are starting to take data privacy and security more seriously.
By Steve Zurier Contributing Writer, 7/22/2019
Comment1 Comment  |  Read  |  Post a Comment
Data Loss, Leakage Top Cloud Security Concerns
Dark Reading Staff, Quick Hits
Compliance, accidental exposure of credentials, and data control are also primary concerns for senior IT and security managers.
By Dark Reading Staff , 7/17/2019
Comment1 Comment  |  Read  |  Post a Comment
GDPR: The Good, the Bad, and the Uncertain
Kacy Zurkus, Contributing Writer
One year post-GDPR implementation it's time to ask the tough question of whether companies are celebrating or cursing these consumer privacy mandates.
By Kacy Zurkus Contributing Writer, 7/16/2019
Comment0 comments  |  Read  |  Post a Comment
Why You Need a Global View of IT Assets
Pablo Quiroga, Director of Product Management at QualysCommentary
It may seem obvious, but many companies lose sight of the fact that they can't protect what they don't know they even have.
By Pablo Quiroga Director of Product Management at Qualys, 7/10/2019
Comment1 Comment  |  Read  |  Post a Comment
Marriott Faces $124 Million GDPR Fine in UK
Dark Reading Staff, Quick Hits
The proposed penalty is for a data breach beginning in 2014 that affected more than 500 million customers worldwide.
By Dark Reading Staff , 7/9/2019
Comment1 Comment  |  Read  |  Post a Comment
Britain Looks to Levy Record GDPR Fine Against British Airways
Robert Lemos, Contributing WriterNews
The penalty is a sign of things to come, say experts.
By Robert Lemos Contributing Writer, 7/8/2019
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16649
PUBLISHED: 2019-09-21
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the...
CVE-2019-16650
PUBLISHED: 2019-09-21
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the se...
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.