Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Taking A Security Program From Zero To Hero
Newest First  |  Oldest First  |  Threaded View
RetiredUser
RetiredUser,
User Rank: Ninja
5/14/2015 | 2:17:03 AM
Step 7: Hackers, Crackers and Phreaks
Let's not forget Step 7 which could take your security group from zero to hero quicker than steps 1-6 (and no, this isn't part of Step 3 - this isn't about "people" in the organizational sense).

Depending on your data and how dire your need is to make sure your security is the tightest it can be, and remains that way, pulling in some underground talent to pick your organization apart can be invaluable.  Nothing helps define the security of a site better than someone dissecting it and handing you the pieces.

I love hearing the old "We have a new security initiative underway.  You may hear from some people looking for your input."  Great.  If I ever actually hear from them, I'll tell them to hire my friend "John Doe" who will do in two hours (identify at least 50 key vulnerabilities and propose fixes) what some "initiatives" take years to do.

Don't get me wrong, I'm old now and Common Criteria and it's EALs and TOEs looks pretty good to me these days.  But Step 7 has to be the go-to sometimes, even if it winds up being off the books.
RyanSepe
RyanSepe,
User Rank: Ninja
5/13/2015 | 1:38:39 PM
The Profit
Step 3 makes me feel like I'm on an episode of The Profit with people, process, and profit.

These are very good guidelines for trying to initiate a security program and even building upon a currently structured security program. You can look at these steps as a high-level process that can help to align an overall structure or a guideline towards implementing individual security protocols. For example you can use these, from an organizational perspective, to implement DLP, etc.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-42003
PUBLISHED: 2022-10-02
In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
CVE-2022-42004
PUBLISHED: 2022-10-02
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
CVE-2022-42002
PUBLISHED: 2022-10-01
SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete.
CVE-2022-39268
PUBLISHED: 2022-09-30
### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end use...
CVE-2022-34428
PUBLISHED: 2022-09-30
Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service.