Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
6 Security Team Goals for DevSecOps in 2020
Assessing Cybersecurity Risk in Today's Enterprise
Car Hacking Hits the Streets
How AI and Cybersecurity Will Intersect in 2020
The Edge Cartoon Caption Contest: Latest Winners, New Toon 'Like a Boss'
News & Commentary
Greater Focus on Privacy Pays Off for Firms
Robert Lemos, Contributing WriterNews
Privacy-mature companies complete sales more quickly, have fewer and less serious breaches, and recover from incidents faster, according to Cisco's annual survey.
By Robert Lemos Contributing Writer, 1/27/2020
Comment0 comments  |  Read  |  Post a Comment
How to Get the Most Out of Your Security Metrics
Curtis Simpson, Chief Information Security Officer at ArmisCommentary
There's an art to reporting security metrics so that they speak the language of leadership and connect the data from tools to business objectives.
By Curtis Simpson Chief Information Security Officer at Armis, 1/27/2020
Comment0 comments  |  Read  |  Post a Comment
New Social Engineering Event to Train Business Pros on Human Hacking
Kelly Jackson Higgins, Executive Editor at Dark ReadingQuick Hits
The DEF CON Social Engineering Capture the Flag contest inspired a new event aimed at teaching both security and non-security professionals on the fine art of hacking human behavior.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/24/2020
Comment0 comments  |  Read  |  Post a Comment
'CardPlanet' Operator Pleads Guilty in Federal Court
Dark Reading Staff, Quick Hits
Russian national faced multiple charges in connection with operating the marketplace for stolen credit-card credentials, and a forum for VIP criminals to offer their services.
By Dark Reading Staff , 1/24/2020
Comment0 comments  |  Read  |  Post a Comment
7 Steps to IoT Security in 2020
Curtis Franklin Jr., Senior Editor at Dark Reading
There are important steps security teams should take to be ready for the evolving security threats to the IoT in 2020.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 1/24/2020
Comment0 comments  |  Read  |  Post a Comment
5 Resume Basics for a Budding Cybersecurity Career
Aditya Sharma, CTO & Co-founder, HirationCommentary
You'll need to add resume tactician to your skill set in order to climb up the next rung on the security job ladder. Here's how.
By Aditya Sharma CTO & Co-founder, Hiration, 1/24/2020
Comment0 comments  |  Read  |  Post a Comment
Online Employment Scams on the Rise, Says FBI
Robert Lemos, Contributing WriterNews
Looking to change jobs? Watch out for fraudsters who use legitimate job services, slick websites, and an interview process to convince applicants to part with sensitive personal details.
By Robert Lemos Contributing Writer, 1/24/2020
Comment0 comments  |  Read  |  Post a Comment
The Annoying MacOS Threat That Won't Go Away
Jai Vijayan, Contributing WriterNews
In two years, the adware-dropping Shlayer Trojan has spread to infect one in 10 MacOS systems, Kaspersky says.
By Jai Vijayan Contributing Writer, 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
DHS Warns of Increasing Emotet Risk
Dark Reading Staff, Quick Hits
Emotet is considered one of the most damaging banking Trojans, primarily through its ability to carry other malware into an organization.
By Dark Reading Staff , 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
NSA Offers Guidance on Mitigating Cloud Flaws
Dark Reading Staff, Quick Hits
A new document separates cloud vulnerabilities into four classes and offers mitigations to help businesses protect cloud resources.
By Dark Reading Staff , 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
Deconstructing Web Cache Deception Attacks: They're Bad; Now What?
Kaan Onarlioglu, Security Architect, AkamaiCommentary
Expect cache attacks to get worse before they get better. The problem is that we don't yet have a good solution.
By Kaan Onarlioglu Security Architect, Akamai, 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
Severe Vulnerabilities Discovered in GE Medical Devices
Kelly Sheridan, Staff Editor, Dark ReadingNews
CISA has released an advisory for six high-severity CVEs for GE Carescape patient monitors, Apex Pro, and Clinical Information Center systems.
By Kelly Sheridan Staff Editor, Dark Reading, 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
Ryuk Ransomware Hit Multiple Oil & Gas Facilities, ICS Security Expert Says
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Attackers 'weaponized' Active Directory to spread the ransomware.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
Weathering the Privacy Storm from GDPR to CCPA & PDPA
Mark McClain, CEO & Co-founderCommentary
A general approach to privacy, no matter the regulation, is the only way companies can avoid a data protection disaster in 2020 and beyond.
By Mark McClain CEO & Co-founder, 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
To Avoid Disruption, Ransomware Victims Continue to Pay Up
Jai Vijayan, Contributing WriterNews
For all the cautions against doing so, one-third of organizations in a Proofpoint survey said they paid their attackers after getting infected with ransomware.
By Jai Vijayan Contributing Writer, 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark ReadingNews
New research finds security operations centers suffer high turnover and yield mediocre results for the investment they require.
By Kelly Sheridan Staff Editor, Dark Reading, 1/22/2020
Comment1 Comment  |  Read  |  Post a Comment
Eight Flaws in MSP Software Highlight Potential Ransomware Vector
Robert Lemos, Contributing WriterNews
An attack chain of vulnerabilities in ConnectWise's software for MSPs has similarities to some of the details of the August attack on Texas local and state agencies.
By Robert Lemos Contributing Writer, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Configuration Error Reveals 250 Million Microsoft Support Records
Dark Reading Staff, Quick Hits
Some the records, found on five identically configured servers, might have contained data in clear text.
By Dark Reading Staff , 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Why DPOs and CISOs Must Work Closely Together
Rajesh Ganesan, Vice President at ManageEngineCommentary
Recent data protection laws mean that the data protection officer and CISO must work in tandem to make sure users' data is protected.
By Rajesh Ganesan Vice President at ManageEngine, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
'We Only Have Two of the Blinky Boxes Left to Go'
Beyond the Edge, Dark Reading
Exactly who is king of the castle here?
By Beyond the Edge Dark Reading, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
Cowbell Cyber Demystifies Cyber Insurance with Cowbell Prime 100
Tripwire Expands Industrial Security Capabilities, Launches Industrial Appliance Line, Joins ISA Global Security Alliance
California Fraudster Sentenced In Maryland To Four Years In Federal Prison For A Credit Card Fraud Scheme With Losses Of More Than $1.365 Million
Florida Man Sentenced in ATM 'Cash-out' Scheme
Kaspersky Researchers Find Lazarus Enhances Capabilities in AppleJeus Cryptocurrency Attack
MITRE Releases Framework for Cyberattacks on Industrial Control Systems
Risk & Assurance Group Joins i3forum to Tackle Voice Fraud in International Telecommunications
Auctus Advises 5nine in Acronis Buyout
More Products & Releases
PR Newswire
edge
7 Steps to IoT Security in 2020
There are important steps security teams should take to be ready for the evolving security threats to the IoT in 2020.
The Y2K Boomerang: InfoSec Lessons Learned from a New Date-Fix Problem
We all make assumptions. They rarely turn out well. A new/old date problem offers a lesson in why that's so.
With International Tensions Flaring, Cyber-Risk Is Heating Up for All Businesses
Risks of nation-state attacks go beyond Iran, and the need for awareness and security don't stop at any national border.
Register for Dark Reading Newsletters
Cartoon Contest
White Papers
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Flash Poll
Video
Slideshows
Twitter Feed