Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Verizon Data Breach Digest Triangulates Humanity Inside Security
Newest First  |  Oldest First  |  Threaded View
mikeroch
50%
50%
mikeroch,
User Rank: Apprentice
2/17/2017 | 9:39:33 PM
Easy 192.168.1.1
Absolutely agree with your thoughts. Nice post btw.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/17/2017 | 6:46:42 PM
Re: "Ridiculously simple"
> we as business people, consumers, IT and cyber security professionals have to get better at picking our battles.

This goes to my consulting philosophy as well.  Increasingly, data security, data privacy, and data compliance are three very different Venn diagram circles with but modest overlaps.  More problematically, however, these three interests sometimes downright conflict with each other!

Ultimately, it's about data stewardship as a whole.  Or, in other words, basic risk management.
T Sweeney
100%
0%
T Sweeney,
User Rank: Moderator
2/13/2017 | 4:12:16 PM
Re: "Ridiculously simple"
Thanks for your comment, HardenStance. There really is very little in information security that is easy or simple, and my "ridiculously simple" characterization was a bit glib. You made several good points, from the threat of the IoT to the need to pick our security battles/priorities carefully. I view the Mobile Assault strategy as a smart way to reduce headaches cut down on headaches for everyone.
HardenStance
100%
0%
HardenStance,
User Rank: Strategist
2/13/2017 | 12:51:07 PM
"Ridiculously simple"

Nice write-up, Terry.

Your term "ridiculously simple" about the Mobile Assault Fix is a more important one than some of us would want to acknowledge, I think.

I agree that for a lot of business travel, temporary suspension of access to some data or some apps while traveling need only be a small price to pay relative to the threat of a serious breach. In the consumer space, the potential risk posed by insecure Internet-enabled toasters and Internet-enabled toothbrushes outweighs the value these things can possibly generate by so many times, it's not even funny. 

Engineers and computer scientists tend to have a "yes we can" mentality to using technology to solve human problems. Without it, horses would still be our main mode of travel and the abacus would still be our main tool for supporting mathematical calculations.

But as we zero-in on making security much more of a priority in light of what adversaries are capable of now, we as business people, consumers, IT and cyber security professionals have to get better at picking our battles.

There will always be lots of use cases in cyber security where we have no choice but to engage in pitched battles against our opponents, facing off with the very latest in cutting edge technology. No quarter asked - and none given. Sometimes with no spending limit either.

But there are also some cyber security battles that are just not worth fighting - engaging in them  actually plays right into the hands of adversaries.

We've got to be better served by more of us being willing to  embrace the full end to end gamut of high tech and low tech cyber security options that are available to us, if only we'd pause to seriously consider them all.

That has to be better than automatically rising to the challenge - or the bait - each and every time.

 



Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5423
PUBLISHED: 2020-12-02
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
CVE-2020-29454
PUBLISHED: 2020-12-02
Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
CVE-2020-7199
PUBLISHED: 2020-12-02
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access,...
CVE-2020-14260
PUBLISHED: 2020-12-02
HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Domino or execute attacker-controlled code on the server system.
CVE-2020-14305
PUBLISHED: 2020-12-02
An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat ...