Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Post-COVID-19 Security Spending Update
A Hacker's Playlist
6 Lessons IT Security Can Learn From DevOps
The Threat from the Internet--and What Your Organization Can Do About It
COVID-19: Latest Security News & Commentary
News & Commentary
RASP 101: Staying Safe With Runtime Application Self-Protection
Nicole Ferraro, Contributing Writer
The dream of RASP is to empower applications to protect themselves. How close do current implementations get to living the dream? Here's what to know.
By Nicole Ferraro Contributing Writer, 9/25/2020
Comment0 comments  |  Read  |  Post a Comment
WannaCry Has IoT in Its Crosshairs
Ed Koehler, Distinguished Principal Security Engineer, Office of CTO, at Extreme NetworkCommentary
The wide variety of devices attached to the Internet of Things offers a rich target for purveyors of ransomware.
By Ed Koehler Distinguished Principal Security Engineer, Office of CTO, at Extreme Network, 9/25/2020
Comment0 comments  |  Read  |  Post a Comment
Malware Attacks Declined But Became More Evasive in Q2
Jai Vijayan, Contributing WriterNews
Most of the malware used in attacks last quarter were designed to evade signature-based detection tools, WatchGuard says.
By Jai Vijayan Contributing Writer, 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
Bluetooth Security Weaknesses Pile Up, While Patching Remains Problematic
Robert Lemos, Contributing WriterNews
Turns out, creating wireless ecosystems for a vast number of different architectures, configurations, and use cases is hard.
By Robert Lemos Contributing Writer, 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
Critical Instagram Flaw Could Let Attackers Spy on Victims
Kelly Sheridan, Staff Editor, Dark ReadingNews
A now-patched remote code execution vulnerability could be exploited with a specially sized image file, researchers report.
By Kelly Sheridan Staff Editor, Dark Reading, 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
Solving the Problem With Security Standards
Adam Shostack, Consultant, Entrepreneur, Technologist, Game DesignerCommentary
More explicit threat models can make security better and open the door to real and needed innovation.
By Adam Shostack Consultant, Entrepreneur, Technologist, Game Designer, 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
CrowdStrike Agrees to Acquire Preempt Security for $96M
Dark Reading Staff, Quick Hits
CrowdStrike plans to use Preempt Security's conditional access technology to strengthen its Falcon platform.
By Dark Reading Staff , 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
Microsoft Warns of Attackers Now Exploiting 'Zerologon' Flaw
Dark Reading Staff, Quick Hits
The Security Intelligence team at Microsoft is tracking newly waged exploits in the wild.
By Dark Reading Staff , 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
Since Remote Work Isn't Going Away, Security Should Be the Focus
Mike Wronski, Technical Director of Product Marketing, NutanixCommentary
These three steps will help organizations reduce long-term work-from-home security risks.
By Mike Wronski Technical Director of Product Marketing, Nutanix, 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
Gaming Industry Hit With 10B+ Attacks In Past Two Years
Nicole Ferraro, Contributing Writer
Criminals scored big with credential stuffing and web app attacks, yet many gamers seem unfazed.
By Nicole Ferraro Contributing Writer, 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
Shopify's Employee Data Theft Underscores Risk of Rogue Insiders
Kelly Sheridan, Staff Editor, Dark ReadingNews
The e-commerce platform has alerted more than 100 merchants of a data breach, highlighting the danger of malicious insiders.
By Kelly Sheridan Staff Editor, Dark Reading, 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
Google Cloud Debuts Threat-Detection Service
Robert Lemos, Contributing WriterNews
Lockdown economics are driving a threat-intelligence business boom. Chronicle Detect is Google's answer to monitoring so much log data created by the distributed workforce.
By Robert Lemos Contributing Writer, 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
India's Cybercrime and APT Operations on the Rise
Jai Vijayan, Contributing WriterNews
Growing geopolitical tensions with China in particular are fueling an increase in cyberattacks between the two nations, according to IntSights.
By Jai Vijayan Contributing Writer, 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
Microsoft's Azure Defender for IoT Uses CyberX Tech
Dark Reading Staff, Quick Hits
Azure Defender for IoT is built to help IT and OT teams discover IoT and OT assets, identify critical flaws, and detect malicious behavior.
By Dark Reading Staff , 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
My Journey Toward SAP Security
Jason Fruge, VP of Business Application CybersecurityCommentary
When applications are critical to the business's core functions, the CISO and their staff better get the security right.
By Jason Fruge VP of Business Application Cybersecurity, 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
Making the Case for Medical Device Cybersecurity
Sarah Katz, Senior Cyber Security Analyst at NASA Ames Research Center
With an increasing number of Internet-connected medical devices in use to manage diabetes, protection against a variety of wireless network attacks could very well be a matter of life and death for patients.
By Sarah Katz Senior Cyber Security Analyst at NASA Ames Research Center, 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
FBI, DHS Warn of 'Likely' Disinformation Campaigns About Election Results
Dark Reading Staff, Quick Hits
Nation-state actors and cybercriminals could wage cyberattacks and spread false information about the integrity of the election results while officials certify the final vote counts.
By Dark Reading Staff , 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
7 Non-Technical Skills Threat Analysts Should Master to Keep Their Jobs
Dov Lerner, Security Research Lead, SixgillCommentary
It's not just technical expertise and certifications that enable analysts to build long-term careers in cybersecurity.
By Dov Lerner Security Research Lead, Sixgill, 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
12 Bare-Minimum Benchmarks for AppSec Initiatives
Ericka Chickowski, Contributing Writer
The newly published Building Security in Maturity Model provides the software security basics organizations should cover to keep up with their peers.
By Ericka Chickowski Contributing Writer, 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
Attackers Target Small Manufacturing Firms
Robert Lemos, Contributing WriterNews
The most common tactics include credential stuffing using valid accounts, various forms of deception, and vulnerabilities in third-party software, Rapid7 says in its latest quarterly threat report.
By Robert Lemos Contributing Writer, 9/22/2020
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by TimKorry
Current Conversations Great tips. Thanks
In reply to: Great tips
Post Your Own Reply
Posted by TiaGilbert
Current Conversations Good article!
In reply to: Article
Post Your Own Reply
More Conversations
Products & Releases
Attacks Against Building Automation, Oil and Gas Industries Up in First Half of 2020
Secureworks Completes Acquisition of Delve Laboratories, Inc.
Thales Empowers Organisations to Simplify the Discovery, Protection and Control of Sensitive Data
New Report Unveils the Most Vulnerable Sectors & Departments to Phishing Attacks
Devo Technology Adds $60 Million in Growth Funding
As Digital Transformation Accelerates, Entrust Datacard Becomes "Entrust"
Cyber Deception Reduces Data Breach Costs by Over 51% & SOC Inefficiencies by 32%
Dashlane Launches Historical Password Health Score Reporting
More Products & Releases
PR Newswire
Security Now Joins Dark Reading

Find out more about the combination of two of the industry's leading cybersecurity news sites.

Making the Case for Medical Device Cybersecurity
With an increasing number of Internet-connected medical devices in use to manage diabetes, protection against a variety of wireless network attacks could very well be a matter of life and death for patients.
Can Schools Pass Their Biggest Cybersecurity Test Yet?
Understaffed, underfunded, and underequipped, IT teams in the K-12 sector face a slew of challenges amid remote and hybrid learning models. Here's where they can begin to protect their schools against cyberattacks.
A Hacker's Playlist
Nine security researchers share their favorite songs and genres.
Register for Dark Reading Newsletters
Cartoon
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13995
PUBLISHED: 2020-09-25
U.S. Air Force Sensor Data Management System extract75 has a buffer overflow that leads to code execution. An overflow in a global variable (sBuffer) leads to a Write-What-Where outcome. Writing beyond sBuffer will clobber most global variables until reaching a pointer such as DES_info or image_info...
CVE-2020-7735
PUBLISHED: 2020-09-25
The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.
CVE-2020-15394
PUBLISHED: 2020-09-25
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution.
CVE-2020-15521
PUBLISHED: 2020-09-25
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) .
CVE-2020-26103
PUBLISHED: 2020-09-25
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Flash Poll
Video
Slideshows
Twitter Feed