Comments
Equifax Data Breach Prompts Calls For Tougher Security Requirements On Data Aggregators
Newest First  |  Oldest First  |  Threaded View
mattrjohnson21
50%
50%
mattrjohnson21,
User Rank: Apprentice
9/16/2017 | 6:12:53 PM
The Cybersecurity Battle - Time to Give Up?
Maybe it is time for a different approach for cybersecurity? See post on LinkedIn below.
https://www.linkedin.com/pulse/give-up-cybersecurity-programs-matthew-r-johnson-cpa-cisa/?trackingId=UbDoa%2BG4FpxaeSIyMQIzGg%3D%3D
lunny
50%
50%
lunny,
User Rank: Strategist
9/8/2017 | 3:13:45 PM
The End Game
Once data is released, there's no getting it back.  Unless something changes, more and more data will be released.  As analytics advances, much more data will be made knowable through inference (having "yellow" and "blue" allows you to infer "green" with great confidence).  We need to focus on how to make private data useless to thieves.  If someone who is not me cannot use my data to impersonate me, then I don't really care that it's out there.  Medical data and other types of personal information is on a different level.  It can be used to extort people who might be vulnerable to such criminal methods.  Part of our problem is that it's still too easy to impersonate someone else with a little bit of their data.  That's the core problem we really aren't addressing.  At some point, we run out of fingers to put in the dike.
cybersavior
100%
0%
cybersavior,
User Rank: Strategist
9/8/2017 | 2:58:12 PM
Dispicable and probably criminal
Equifax is dispicable to include an arbitration clause in the sign-up acknowledgement as a prerequisite in front of the free credit monitoring offering.  That consent waives a consumers right to class action.

The EFX stock sales by company officers following the breach (some $1.8M) should be investgated by the SEC, too.


WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Mirai Hackers' Sentence Includes No Jail Time
Dark Reading Staff 9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17243
PUBLISHED: 2018-09-20
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.
CVE-2018-17232
PUBLISHED: 2018-09-20
SQL injection vulnerability in archivebot.py in docmarionum1 Slack ArchiveBot (aka slack-archive-bot) before 2018-09-19 allows remote attackers to execute arbitrary SQL commands via the text parameter to cursor.execute().
CVE-2018-17233
PUBLISHED: 2018-09-20
A SIGFPE signal is raised in the function H5D__create_chunk_file_map_hyper() of H5Dchunk.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
CVE-2018-17234
PUBLISHED: 2018-09-20
Memory leak in the H5O__chunk_deserialize() function in H5Ocache.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
CVE-2018-17235
PUBLISHED: 2018-09-20
The function mp4v2::impl::MP4Track::FinishSdtp() in mp4track.cpp in libmp4v2 2.1.0 mishandles compatibleBrand while processing a crafted mp4 file, which leads to a heap-based buffer over-read, causing denial of service.