Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
8 Most Overlooked Security Threats
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
JackieHorn09
50%
50%
JackieHorn09,
User Rank: Apprentice
1/7/2019 | 9:16:51 PM
Newbie
I am a 33-year-old female, with no military affiliation just getting started with my bachelor's in cybersecurity.  Any thoughts or help to get started? Will my age and the fact that I have no prior military hurt me? 
EricT981
50%
50%
EricT981,
User Rank: Author
6/13/2017 | 2:57:17 PM
Re: Awareness training
It's easy to get excited about 0-days and network security because technology solutions are easier than human solutions. Education is important, but so is accountability: Security teams need to start bringing other teams (infrastructure, dev) into the fray.
stevejennings
50%
50%
stevejennings,
User Rank: Strategist
6/7/2017 | 9:00:53 AM
Re: Malvertising
64% of Americans work from home? Really? Perhaps you meant 64% of IT professionals? And even that sounds high.
ebyjeeby
100%
0%
ebyjeeby,
User Rank: Strategist
6/6/2017 | 2:04:45 PM
Re: 8 Most Overlooked Security Threats
z/OS and NSK are very secure, nothing like *nix and Windows.
tadwhitaker
100%
0%
tadwhitaker,
User Rank: Author
6/5/2017 | 2:48:12 PM
IOT
The threat of connected devices can't be overstated enough. It needs to be the next phishing, in terms of public awareness. Particularly as voice-activated assistants are widely adopted.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
6/2/2017 | 4:33:51 PM
Re: Awareness training
@Dr.T: I'm not even so sure about the "more than ever"... Hackers have long known that social engineering is where it's at.  And Kevin Mitnick taught us this through his own exploits back in the day.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
6/2/2017 | 4:32:13 PM
Re: Malvertising
@Dr.T: Incorrect. But most if not all video would be disabled. And then for the sites you explicitly trust, you could enable as needed.
ronbo1963
100%
0%
ronbo1963,
User Rank: Apprentice
5/31/2017 | 11:54:53 AM
Re: 8 Most Overlooked Security Threats
Spot on. I started my IT career working in a IBM Mainframe environment. The economy of scale of going back to that platform would be a tremendous benefit to any corporate enterprise. When the top 50 banks in the world rely on z/OS as their primary server environment what do they know that the rest of the corporate world do not....... P.S. 35 years IT. Also performed the Common Criteria Evaluation of two to the z/OS security filters. Much more robust and safe than other platform implementations.....
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
5/30/2017 | 4:39:24 PM
Re: Awareness training
This is the bigger issue in security: Creating a culture of security.  Having the best security systems in the world technologically do little good if people are just willing to hand over login information, click on links willy-nilly, and let strangers into their datacenters.
tcritchley07
100%
0%
tcritchley07,
User Rank: Moderator
5/30/2017 | 2:23:39 PM
Re: 8 Most Overlooked Security Threats
I'm afraid all OSes are not the same. Windows is a ramshackle lash-up which changes every version and is wide open to abuse. z/OS is far more robust and defendable than Windows and is capable of protecting Linux running under it. The 3rd party apps that run with Windows to give the total internet environment were not designed together and are bolt-ons with the same potential for interference with each other and by the bad guys. We all know that certain apps will not coexist on Windows and some have brought my system down before I uninstalled them.

PS I am not an apprentice but have nearly 50 years in IT as practitioner latterly as an author.
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...