Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
6 Security Team Goals for DevSecOps in 2020
Assessing Cybersecurity Risk in Today's Enterprise
Car Hacking Hits the Streets
How AI and Cybersecurity Will Intersect in 2020
The Edge Cartoon Caption Contest: Latest Winners, New Toon 'Like a Boss'
News & Commentary
To Avoid Disruption, Ransomware Victims Continue to Pay Up
Jai Vijayan, Contributing WriterNews
For all the cautions against doing so, one-third of organizations in a Proofpoint survey said they paid their attackers after getting infected with ransomware.
By Jai Vijayan Contributing Writer, 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark ReadingNews
New research finds security operations centers suffer high turnover and yield mediocre results for the investment they require.
By Kelly Sheridan Staff Editor, Dark Reading, 1/22/2020
Comment1 Comment  |  Read  |  Post a Comment
Eight Flaws in MSP Software Highlight Potential Ransomware Vector
Robert Lemos, Contributing WriterNews
An attack chain of vulnerabilities in ConnectWise's software for MSPs has similarities to some of the details of the August attack on Texas local and state agencies.
By Robert Lemos Contributing Writer, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Configuration Error Reveals 250 Million Microsoft Support Records
Dark Reading Staff, Quick Hits
Some the records, found on five identically configured servers, might have contained data in clear text.
By Dark Reading Staff , 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Why DPOs and CISOs Must Work Closely Together
Rajesh Ganesan, Vice President at ManageEngineCommentary
Recent data protection laws mean that the data protection officer and CISO must work in tandem to make sure users' data is protected.
By Rajesh Ganesan Vice President at ManageEngine, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
'We Only Have Two of the Blinky Boxes Left to Go'
Beyond the Edge, Dark Reading
Exactly who is king of the castle here?
By Beyond the Edge Dark Reading, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Startup Privafy Raises $22M with New Approach to Network Security
Dark Reading Staff, Quick Hits
The company today disclosed an approach to data security designed to protect against modern threats at a lower cost than complex network tools.
By Dark Reading Staff , 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Cybersecurity Lessons Learned from 'The Rise of Skywalker'
Matt Davey, Chief Operations Optimist, 1PasswordCommentary
They're especially relevant regarding several issues we face now, including biometrics, secure data management, and human error with passwords.
By Matt Davey Chief Operations Optimist, 1Password, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Microsoft, DHS Warn of Zero-Day Attack Targeting IE Users
Robert Lemos, Contributing WriterNews
Software firm is "aware of limited targeted attacks" exploiting a scripting issue vulnerability in Internet Explorer 9, 10, and 11 that previously has not been disclosed.
By Robert Lemos Contributing Writer, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
New Ransomware Tactic Shows How Windows EFS Can Aid Attackers
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers have discovered how ransomware can take advantage of the Windows Encrypting File System, prompting security vendors to release patches.
By Kelly Sheridan Staff Editor, Dark Reading, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
FireEye Buys Cloudvisory
Dark Reading Staff, Quick Hits
The purchase is intended to bring new cloud capabilities to the FireEye Helix security platform.
By Dark Reading Staff , 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
Avoid That Billion-Dollar Fine: Blurring the Lines Between Security and Privacy
Jean-Michel Franco, Senior Director of Product Marketing at TalendCommentary
While doing good for the user is the theoretical ideal, the threat of fiscal repercussions should drive organizations to take privacy seriously. That means security and data privacy teams must work more closely.
By Jean-Michel Franco Senior Director of Product Marketing at Talend, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
Ransomware Upgrades with Credential-Stealing Tricks
Dark Reading Staff, Quick Hits
The latest version of the FTCode ransomware can steal credentials from five popular browsers and email clients.
By Dark Reading Staff , 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
Nearly 75% of SD-WAN Owners Lack Confidence Post-Digital Transformation
Dark Reading Staff, Quick Hits
More businesses think SD-WAN will reduce WAN costs, but only 37% think SD-WANs will help defend against malware and other threats.
By Dark Reading Staff , 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
Data Awareness Is Key to Data Security
Moti Gindi, Corporate Vice President, Microsoft Defender Advanced Threat ProtectionCommentary
Traditional data-leak prevention is not enough for businesses facing today's dynamic threat landscape.
By Moti Gindi Corporate Vice President, Microsoft Defender Advanced Threat Protection, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
Elaborate Honeypot 'Factory' Network Hit with Ransomware, RAT, and Cryptojacking
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
A fictitious industrial company with phony employees personas, website, and PLCs sitting on a simulated factory network fooled malicious hackers - and raised alarms for at least one white-hat researcher who stumbled upon it.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading
Looking to switch things up but not sure how to do it? Security experts share their advice for switching career paths in the industry.
By Kelly Sheridan Staff Editor, Dark Reading, 1/21/2020
Comment1 Comment  |  Read  |  Post a Comment
China-Based Cyber Espionage Group Reportedly Behind Breach at Mitsubishi Electric
Jai Vijayan, Contributing WriterNews
Personal data on over 8,100 individuals and confidential business information likely exposed in June 2019 incident.
By Jai Vijayan Contributing Writer, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
Are We Secure Yet? How to Build a 'Post-Breach' Culture
Rich Armour, Former General Motors CISO & an advisor to Nozomi NetworksCommentary
There are many ways to improve your organization's cybersecurity practices, but the most important principle is to start from the top.
By Rich Armour Former General Motors CISO & an advisor to Nozomi Networks, 1/20/2020
Comment0 comments  |  Read  |  Post a Comment
The Y2K Boomerang: InfoSec Lessons Learned from a New Date-Fix Problem
Curtis Franklin Jr., Senior Editor at Dark Reading
We all make assumptions. They rarely turn out well. A new/old date problem offers a lesson in why that's so.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 1/20/2020
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
Cowbell Cyber Demystifies Cyber Insurance with Cowbell Prime 100
Tripwire Expands Industrial Security Capabilities, Launches Industrial Appliance Line, Joins ISA Global Security Alliance
California Fraudster Sentenced In Maryland To Four Years In Federal Prison For A Credit Card Fraud Scheme With Losses Of More Than $1.365 Million
Florida Man Sentenced in ATM 'Cash-out' Scheme
Kaspersky Researchers Find Lazarus Enhances Capabilities in AppleJeus Cryptocurrency Attack
MITRE Releases Framework for Cyberattacks on Industrial Control Systems
Risk & Assurance Group Joins i3forum to Tackle Voice Fraud in International Telecommunications
Auctus Advises 5nine in Acronis Buyout
More Products & Releases
PR Newswire
edge
The Y2K Boomerang: InfoSec Lessons Learned from a New Date-Fix Problem
We all make assumptions. They rarely turn out well. A new/old date problem offers a lesson in why that's so.
With International Tensions Flaring, Cyber-Risk Is Heating Up for All Businesses
Risks of nation-state attacks go beyond Iran, and the need for awareness and security don't stop at any national border.
How to Keep Security on Life Support After Software End-of-Life
It's the end of support this week for Windows 7 and Server 2008. But what if you truly can't migrate off software, even after security updates stop coming?
Register for Dark Reading Newsletters
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I've never actually seen the corporate ladder before.
White Papers
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5216
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seei...
CVE-2020-5217
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could b...
CVE-2020-5223
PUBLISHED: 2020-01-23
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3...
CVE-2019-20399
PUBLISHED: 2020-01-23
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
CVE-2020-7915
PUBLISHED: 2020-01-22
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Flash Poll
Video
Slideshows
Twitter Feed